About this case:

• Judgment:
  External link

In finding that Facebook could only be held liable for a limited 10-day period in which information about the man was published on one Facebook page, Lord Chief Justice Morgan stated that the Court of Appeal would decide upon the reduced quantum of damages at a later date.

Background

Facebook Ireland Ltd appealed an Order of the High Court which held Facebook liable to a convicted sex offender known as “CG” for misuse of private information in respect of three profile pages on its social network, together with the comments generated by those pages – awarding £20,000 in damages.

CG cross appealed on the basis that Facebook should be held liable in respect of the three profile pages and comments on the basis that by its pursuit of economic activity within the United Kingdom by operation of the Facebook social network and through the operation of an office, branch and/or subsidiary it is a data controller under section 5 of the Data Protection Act 1998 in respect of personal data and sensitive personal data processed on the Facebook social network and is in breach of the Data Protection Act 1998.

The Court heard that in 2007, CG was sentenced to 10 years’ imprisonment for offences of indecent assault and gross indecency. At the time of his conviction, the Irish News carried an article which identified CG by name, stated that he had been convicted of a specific number of sex offences, and included a photograph of CG along with other information about CG’s case.

CG was released on licence on 27 February 2012, and on 22 April 2013 Mr Joseph McCloskey posted a copy of the article which had been published in the Irish News together with the photograph of CG on his page entitled “Keeping Our Kids Safe from Predators 2”.

This posting attracted more than 150 comments, many of which were hostile to CG. Despite the request for restraint the comments included abusive language, violent language including expressions of support for those who would commit violence against CG, and references to where he was living or may be living.

High Court

In the High Court, the case made against Facebook was based on misuse of private information – i.e. that in respect of which there is a reasonable expectation of privacy.

Approving Murray v Express Newspapers EWCA Civ 446, the test was objective and had to be applied broadly, so that the Court would consider the individual’s attributes, the nature of the activity in which he had been involved, the place where it had happened, and the nature and purpose of the intrusion.

Also considered, was the fact that Facebook is an information society service (ISS) within the meaning of Directive 2000/31/EC (the e-Commerce Directive). Article 15 of the e-Commerce Directive provides that a general obligation shall not be imposed on an ISS provider to monitor the information which they transmit or store. Nor is there a general obligation actively to seek facts or circumstances indicating illegal activity.

Under the Electronic Commerce (EC Directive) Regulations 2002 an ISS will not be liable for damages where it does not have actual knowledge of unlawful activity or information and is not aware of facts and circumstances from which it would have been apparent to the service provider that the activity or information was unlawful. If it obtained such knowledge then it will not be liable if it acts expeditiously to remove or disable access to such information.

The trial judge held that neither the e-Commerce Directive nor the 2002 Regulations provided any defence to the claim of misuse of private information, and ultimately awarded CG £20,000 compensation.

Court of Appeal

Justice Morgan stated that the Court agreed with much of the trial judge’s analysis of the law concerning the tort of misuse of private information – adding that the values protected by Article 8 of the Convention, particularly autonomy and dignity, are at the core of the cause of action. The tort protects both confidentiality and intrusion.

The determination of whether the repetition or disclosure of private information achieves the level of intrusion protected by Article 8 of the Convention is inevitably fact sensitive. In conducting that exercise, the Court accepted that the context can include the disclosure or repetition of information which itself is not protected but which together with other private information can lead to unlawful intrusion.

Justice Morgan was satisfied that it was clear from the judge’s conclusion that he was particularly alert to the risks posed as a result of the identification of CG’s address; and that in view of the campaign of harassment and threatened violence to the offender, the identification of the locality in which he was living, his name, photograph and the circumstances of the offending – this was cumulatively information in respect of which CG had a reasonable expectation of privacy because of the risk that those who wished to do him harm could have established his whereabouts in order to do so.

Allowing the cross-appeal for CG in that Facebook is a data controller for the purposes of section 5 of the Data Protection Act 1998, Justice Morgan stated that the principal argument advanced by Facebook was that it was established in a member state of the EU, Ireland, and was regulated in terms of data protection by the domestic law of that member state which implemented the Data Protection Directive.

In all of the circumstances, the Court allowed Facebook’s appeal in that it was entitled to the protection of the e-Commerce Regulations against claims for damages under the Data Protection Act 1998 – however the Court found that Facebook was liable to CG in damages for misuse of private information for the period from 26 November 2013 until 4/5 December 2013 in respect of one of the pages.