High Court of Justice in Northern Ireland Queen's Bench Division Decisions

Neutral Citation No. [2015] NIQB 103	Ref:	HOR9821
Judgment: approved by the Court for handing down	Delivered:	18/12/2015
(subject to editorial corrections)*

 

 

IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND

 

________

 

QUEEN’S BENCH DIVISION

 

________

 

Between

YZ

Plaintiff

and

 

GOOGLE INCORPORATED

and

AUT O’MATTIC A8C IRELAND LTD t/as WORDPRESS.COM

and

PERSONS OPERATING UNDER THE PSEUDONYM UNIFORM RESOURCE

LOCATOR

HTTPS://FATHERMURPHY.WORDPRESS.COM

Defendants

________

 

HORNER J

 

Introduction

 

[1]        This is an application by YZ to whom an order for anonymity was granted for leave to serve proceedings out of the jurisdiction on the first named defendant, Google Incorporated (“Google”), under Order 11 of the Rules of the Supreme Court (NI) 1980. 

 

[2]        The plaintiff makes his application on three different grounds, which can either be considered separately or cumulatively.  First of all he relies on Order 11 Rule 1(1)(b), namely that as part of the relief the plaintiff seeks an injunction ordering Google to refrain from carrying out certain acts within this jurisdiction relating to information which is confidential to him.

 

Secondly, he relies on Order 11 Rule 1(1)(c) namely that the claim was brought against a person duly served within or out of the jurisdiction and a person out of the jurisdiction who is a necessary party thereto.

 

Thirdly, and finally he relies on Order 11 Rule 1(1)(f) namely that the claim is founded on a tort and the damage was suffered or resulted from an act committed, within the jurisdiction. 

 

[3]        This is an ex parte application, although Google was put on notice that it was to be made.  It has declined to take any part in the application.

 

Background Facts

 

[4]        The plaintiff issued proceedings against Sunday Newspapers Ltd t/a The Sunday World.  He secured an interim injunction restraining the Sunday World, its servants and agents, from “publishing, distributing or transmitting any information by any means suggested that the appellant provide information to the state authorities about any criminal activities”. 

 

[5]        Subsequently, a High Court judge granted leave to YZ to issue contempt proceedings under Order 52 Rule 2 on the basis that following the Court of Appeal’s delivery of its judgment, the Sunday World published an article which breached the terms of the Order. The court was advised that Google was informed of the Order and urged to remove any objectionable material which identified YZ as an informer from as early as 5 November 2014. A further request was made on 4 March 2015.

 

[6]        The complaint made by YZ in the present proceedings is that information has been available on the internet which continues to identify him as providing information to the state authorities about criminal activities.  YZ complains that the main publications cited by the Sunday World article were available on a website run by the second named defendant.  This is a company which is registered in the Republic of Ireland.  However, proceedings have been duly served upon it. 

 

[7]        YZ further complains that when a search is carried out on Google using the plaintiff’s name and the word “informant” or “tout”, “cached” material appears identifying YZ as a police informant, inter alia, supplying bugged cars to terrorists.  For example, one of the excerpts states:

 

“Attack on [YZ], police believe this refers to you … being a murder [sic] and of being an informant supplying bugged cars to terrorists.”

 

[8]        It appears that these may have been blocked so as to prevent access to UK users.  There was some suggestion that they can be accessed via virtual private networks (“VPNs”) and/or proxy servers.  There is no evidence before the court that this in fact has happened. 

 

[9]        Google operates the search engine known as Google. Its position as to whether it is a data controller in respect of any personal data belonging to YZ is presently unknown. Its position in other cases suggests it may deny this. However there are good grounds for considering that it is a data controller when operating as a search engine: see Google Spain SL: and Google Inc v Agencia Espanola de Datos and anor [2014] 3 WLR 659.

 

Service out of the jurisdiction

 

[10]      The plaintiff claims against Google and relies on a number of different causes of action.  Given that this is an ex parte application the plaintiff must disclose everything which casts doubt on his case. It is unreasonable to expect him to anticipate all the arguments or points which might be deployed against the claims he is making: see Electric Finance Co v Sales Corp (2014) 3 WLR 569.

He claims for:

 

(i)        The tort of misuse of private information.

 

(ii)       Breaches of the Data Protection Act 1998.

 

(iii)      Breach of the Data Protection Directive 95/46/EC.

 

(iv)      Breach of Article 8 of the European Convention of Human Rights.

 

(v)       Breach of the EU Charter.

 

[11]      The test for service out of the jurisdiction is threefold. 

 

(i)        The plaintiff must show that there is a serious action to be tried for the existence of the cause of action.

 

(ii)       The plaintiff must show a good arguable case that the alleged cause of action against the foreign defendant comes within one of the gateways set out at Order 11 Rule 1.

 

(iii)      Finally, the plaintiff must demonstrate that in all the circumstances Northern Ireland is clearly or distinctly the appropriate forum in which to try the issues that arise between the parties: see VTB Plc v Nutritek International Corp [2012] 2 Lloyd's Rep 313.

 

Misuse of Private Information

 

[12]      Following the coming into effect of the Human Rights Act 1998 (“HRA”) on 2 October 2000, domestic law in Northern Ireland changed so as to become more consistent with the protection of privacy offered by Article 8 of the European Convention on Human Rights (“The ECHR”).  The old law of breach of confidence was reworked by the House of Lords in Campbell v MGN Ltd [2004] UKHL 22 to create effectively a new Convention compliant tort of the misuse of private information.  The constituent elements of this tort are:

 

(a)        Publication.

 

(b)       Without consent.

 

(c)        Of information in respect of which a person had a “reasonable expectation of privacy”.

 

[13]      There can be no doubt that YZ did not give his consent to this information being published.  It is also clear that it was information of which YZ had a “reasonable expectation of privacy”.  In AB v Sunday Newspapers t/a Sunday World [2014] NICA 58 the Court of Appeal said at [23]:

 

“We are satisfied, therefore, that a person acting as a convert (sic) human intelligence source or informer has a reasonable expectation that his confidential relationship will not be disclosed.”

 

[14]      This is not a case in which YZ needs to prove that any content has been downloaded, and thus published: see Carrie v Tolkien [2009] EWHC 29.  The confidential information appeared as a consequence of the search being carried out and is described as cached information.  I am satisfied on balance that there is a good arguable case made out on the basis of the affidavits filed in this case that given the judgments of the Court of Appeal and the High Court judge in which YZ’s name is not anonymised and the controversy generated by the second named defendant’s blog that any searches will most likely have been carried out in Northern Ireland disclosing the cached information about which complaint is made. 

 

The Data Protection Act 1998

 

[15]      The 1998 Act is a further means by which the UK seeks to discharge its obligations under the ECHR and, in particular, Article 8, which is intended to prevent an interference with an individual’s private life.  It should be interpreted in accordance with the Council Directive and the EU Charter.  I do not consider that either of these add anything and presumably have been put forward on a “belt and braces” approach.

 

[16]      Under the 1998 Act “sensitive personal data” under Section 2 means personal data consisting of information as to … “commission or alleged commission by him of any offence”.

 

[17]      In Google Spain SL and another v Agencia Espanola v de Proteccion de Datos (AEPD) and another [2014] 3 WLR 659 the European Court of Justice concluded that the activity of the Google search engine constituted the “processing of personal data” and that the operator of the engine was the “controller”.

 

[18]      In Judith Vidal-Hall and others v Google Inc [2014] EWHC 13 Tugendhat J concluded that whether or not damages were recoverable under Section 13 of the 1998 Act was a “controversial question of law in a developing area”.  He thought it was desirable that the facts should be found.  However, he was of the view that damage in Section 13 did include “non-pecuniary damage” and that therefore general damages were available for distress. 

 

[19]      Under the Electronic Commerce (EC Directive) Regulations 2002 (“the 2002 Regulations”) an  information society service (“ISP”) will not be liable in damages where it does not have actual knowledge of “unlawful activity or information” and is unaware of facts or circumstances from which it would have been apparent to the ISS that the activity information was unlawful.  Once the ISS obtains such knowledge then it will not be liable if it acts with due haste to remove or disable access to the offending information.  No evidence has been filed by Google in this case to date and it is not possible to test any defence that Google acted as soon as possible when it received proper notification from the plaintiff.  Evidence will need to be filed on this issue. However on the evidence before this court Google was informed of the offending material as far back as November 2014 and according to the information placed before this court failed to take effective steps to preclude access to it from the citizens of Northern Ireland. 

 

[20]      In Mosley v Google Inc and Others [2015] EWHC 59 (QB) Mitting J said at [46]:

 

“Leaving aside legal niceties, what matters is whether or not a person whose sensitive personal data has been wrongly processed by an internal service provider can ask the court to order it to take steps to cease to publish that data.”

 

He concluded that this was a viable claim.

 

Council Directive and EU Charter

 

[21]      The 1998 Act was part of the Government’s attempt to bring in to affect the Council Directive 94/46/EC (“the Directive”).  The act should be interpreted in conformity with the Directive, so far as is possible.  In the circumstances I do not think that the directive which is now set out in the EU Charter of Human Rights, adds anything to the claims previously discussed. 

 

VPNs and Proxy Servers

 

[22]      There has been absolutely no evidence adduced that any citizens in Northern Ireland used VPNs or proxy servers to access confidential information about YZ which has been processed or controlled by Google. The plaintiff relied on Cartier International and others v Open Right Group [2014] EWHC 3354 (Ch) as authority for the proposition that this court could take action to prevent the use of proxy servers. But in that case there was evidence before the court of English citizens who were using VPNs/proxy servers to commit torts and break the law.

 

Conclusion

 

 

[23]      I reach the following conclusions:

 

(a)        A good arguable case has been made that both causes of action come within Order 11 Rule 1(1)(b) namely an injunction is sought to refrain the defendant from continuing to breach of the 1998 Act and  commit the tort of Misuse of Private Information.

 

(b)       I am satisfied that Google is a necessary or proper party to a claim which has already been made against the second named defendant who has published the offending blog and which has been duly served on it.  The evidence establishes that there is a good arguable case that the alleged cause of action falls within Order 11 Rule 1(1)(c). The plaintiff may for good reason decide that Google is a better target for damages than the other defendants.

 

(c)        Finally, there is a good arguable case that the claims of misuse of private information and breach of the 1998 Act are torts and that damage has been suffered by YZ in Northern Ireland from acts committed within the jurisdiction.

 

(d)       There are serious issues to be tried for the existence of both causes of action, as appears from the papers filed on behalf of the plaintiff.

 

(e)        Northern Ireland is clearly and distinctly the most appropriate jurisdiction to hear these issues that arise between the Plaintiff and the Defendants in respect of the two causes of action previously identified in the judgment.