The High Court has in the case of Sabados v Facebook Ireland compelled Facebook to reveal who posed as a family member to secure the deletion of a deceased man's profile, which resulted in a devastating loss of personal material for his partner.
The deceased's longstanding partner and claimant, Ms Sabados, sought an order requiring Facebook to disclose the identity of the requester, against whom she could then bring a claim for misuse of private information and/or breach of confidence, as well as breach of the Data Protection Act 1998 ("DPA"). The material posted by the deceased - and subsequently deleted - included music videos, poems and photographs, as well as six years' worth of the couple's private and intimate correspondence, some of which, the Judge held, would constitute the claimant's personal data under the DPA.
Facebook had refused to confirm who requested the deletion, saying only that it was a family member and that normal processes were followed.
The courts have discretion to grant what is known as a Norwich Pharmacal order ("NPO"), where a claimant is unable to identify an ultimate wrongdoer but can target a third party it knows holds that information. In order to obtain an NPO, the claimant needs to satisfy the court that (i) they have a good arguable case; (ii) they cannot proceed with their intended claim(s) without an order; and (iii) the defendant is "mixed up" in the unknown person's wrongdoing.
In his full judgment, released this week, HHJ Parkes QC held that all three threshold conditions were satisfied, as was the underlying purpose of the remedy, to do justice: "Unless the court makes the order sought, the claimant will have no remedy whatever for very hurtful, distressing and on the face of it, very possibly malicious behaviour by the person unknown."
The Judge did however have some initial misgivings about accepting jurisdiction – particularly where Facebook did not attend the hearing - in a case where the actions complained of took place in the Republic of Ireland (where Facebook Ireland is incorporated) and possibly Bosnia (where the deceased lived), but the alleged damage was suffered in England (where the claimant lives). Where a defendant is domiciled in an EU Member State, the general rule is that they should be sued in their place of domicile, in this case the Republic of Ireland. But, Article 7(2) of the Recast Brussels Regulation makes it clear that a defendant can also be sued in another Member State, in a matter relating to tort such as defamation or malicious falsehood, "in the courts for the place where the harmful event occurred or may occur".
Ultimately, the Judge was persuaded that, for the purposes of Article 7(2), England was the place where the damage occurred, and that an NPO could be enforced in other Member States without any further special procedures.
The case should serve as a reminder of the potential consequences of disclosing and/or deleting personal data without the appropriate authority.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
