Analysis
The Claimant, who was a British citizen, was born in Bosnia but had lived in London since 1992. She formed a romantic relationship with a childhood friend called Mirza Krupalija (“Mirza”), following his divorce, which lasted six years until his death in March 2016. Their relationship was for the most part conducted at long distance, although they spent around seven weeks a year together in Bosnia. Mirza used a social media platform operated by the Defendant to post his music, photographs, poems and other personal data. According to the Claimant, some of the data on Mirza‘s Facebook page would have included her own because it contained all of the intimate messages which they exchanged over the years. After Mirza‘s death, she was treated by his family as his wife and allowed to make the decisions about his funeral arrangements. However, six months after his death, the Defendant received and acceded to a request from a person unknown to delete his account. As a result, the material posted by him (including his music, photographs, poems and other personal data) was deleted and could not be recovered. The Defendant would not reveal who had requested the deletion, except that it was a family member, and maintained that their normal processes were followed. The Claimant, who was devastated by the loss of so much material which was the fruit of her relationship with Mirza, issued a Part 8 Claim Form requesting a Norwich Pharmacal order against the Defendant on 10 December 2017. The Defendant did not acknowledge service but, on 14 April 2018, the London office of White & Case LLP sent, to the Claimant, a notice of acting on behalf of the Defendant. The Defendant, who was informed of the hearing, was not present or represented.
Held (making the order sought):
The Claimant needed to obtain Norwich Pharmacal relief in order to identify the person who had secured the deletion of Mirza‘s profile because there was likely to have been a breach of the Data Protection Act as well as a breach of confidence and/or misuse of private information. As regards jurisdiction, authority suggested that the relevant Convention was to be construed as referring both to the place where the tortious act occurred and the place where the damage occurred, giving a claimant the option of suing in either jurisdiction. Ultimately, there was no reason of principle why the conclusion could not be reached that the Claimant had an arguable case to maintain a claim against the Defendant (in the Republic of Ireland) on the footing that this was the place where the damage occurred for the purpose of Art 7(2) and, by virtue of Norwich Pharmacal relief, against the unknown person for a substantive action founded on breach of data protection principles, breach of confidence and misuse of private information. No doubt, if there was jurisdiction to make such an order, then it could be enforced in the Republic of Ireland under the Brussels Recast Regulation. Three conditions had to be satisfied for the Court to exercise its power to grant Norwich Pharmacal relief, namely
- (i) a wrong must have been carried out, or arguably carried out, by an ultimate wrongdoer;
- (ii) there must be a need for an order to enable action to be brought against the ultimate wrongdoer; and
- (iii) the person against whom the order was sought must be mixed up in the facilitation of the wrongdoing and be able, or likely to be able, to provide the information necessary to enable the ultimate wrongdoer to be sued.
As to the first condition, there was a good arguable case that a person unknown posing as a family member contacted the Defendant to seek the deletion of Mirza ‘s profile after his death and will have had access to that profile prior to its deletion thereby giving rise to claims for breach of the data protection legislation, breach of confidence and/or misuse of private information. As to the second condition, the information sought was necessary not only to identify the person unknown but also to formulate claims on the basis of the representations made by that person to the Defendant. As to the third condition, the Defendant was a social media platform which hosted the personal data that had been deleted and was therefore unequivocally mixed up in the unknown person‘s wrongdoing and likely to hold the information required. Accordingly, all three conditions were satisfied, and the order sought would be made.
HHJ PARKES QC [1] This is my judgment on the application by Ms. Azra Sabados for a Norwich Pharmacal order against the defendant, Facebook Ireland Limited. The claimant is represented by Mr. Callus. [2] The claimant is a British citizen who was born in Bosnia but who has lived in London since the Yugoslav war …Continue reading "Sabados v Facebook Ireland [2019] WTLR 1361"