The Claimant (C) sought damages in respect of the publication of a fake Facebook profile, as well as a blog which had been created on Blogger (a service owned by Google Inc). She maintained that each was defamatory of her and infringed her right to respect for her private life under Article 8.
C did not sue the original poster. Instead, she brought proceedings against ‘Facebook’ in respect of the Profile and against Google UK Limited in respect of the Blog.
On 24 and 26 June 2015 Master Kay QC struck out both actions, primarily on the ground that in each action C had sued, or attempted to sue, a company which could not be responsible for the complained of publication. C appealed those decisions. She also sought to refer a number of issues to the CJEU for a preliminary ruling, including a question as to whether the CJEU’s approach in Costeja v Agencia Española de Protección de Datos (AEPD)  QB 1022 meant that local subsidiaries could be held liable for data processing carried out by a parent entity.
C’s appeals were dismissed in both actions.
A wide-ranging judgment which was obliged to cover a substantial amount of ground. A number of points, however, are likely to be of particular assistance in the future.
Firstly, the judgment addresses head-on a misconception which has frequently arisen in the context of internet intermediary cases – i.e. that a claimant is able to sue a UK subsidiary of a foreign online service provider as an alternative to satisfying the gateway criteria required to obtain permission to serve out of jurisdiction on the parent itself. Such an approach is irreconcilable with the test for legal responsibility in defamation. As Warby J highlighted, an online ‘noticeboard’ provider could become liable post-notification according to the principles first articulated in Byrne v Deane but only if it was in control of the relevant ‘noticeboard’ and had the power to act so as to remove a posting by a third party which was unauthorised and wrongful . Given that C was unable to advance a coherent case either Facebook UK and Google UK in respect of either platform, her claim in defamation against fell to be struck out.
Secondly, the Judge rejected C’s argument that the CJEU’s reasoning in Costeja meant that a UK subsidiary could be held liable for data processing which was alleged to have been carried out by a foreign parent. Warby J held that this argument was misconceived on numerous levels. As he noted, the CJEU’s decision in Costeja concerned the scope and application of the Data Protection Directive (95/46/EC) and therefore had no bearing on the approach to legal responsibility in the English law of defamation or in the context of a claim brought under Article 8 of the ECHR . In addition, the aspect of the CJEU’s decision in Costeja on which C relied in this regard was concerned with the territorial application of that Directive. The CJEU’s conclusion had been that data processing undertaken by Google Inc. for the purpose of providing its Google Search facility to a Spanish audience was carried out ‘in the context of the activities of an establishment [i.e. Google Spain] of the controller on the territory of the member state’. However, the relevant data controller remained Google Inc., not Google Spain, and the analogies which C sought to draw with Costeja provided no basis for a claim to be brought in English data protection law against either Facebook UK or Google UK [58-59] and [74-75].
Finally, at [49-50], the judgment identifies a point which arose in the context of the Facebook UK action over whether s.8 Defamation Act 2013 (the so-called ‘single publication rule’) applies to cases where the first publication took place before the 2013 Act came into force. Facebook UK argued that because the January 2014 publication was, on C’s own case, the same as the publication of May 2013, limitation expired in May 2014 (some 8 months before the issue of the claim form). Warby J acknowledged that there was room for debate about whether the new rule applies to a case where the first publication took place before the 2013 Act came into force, but noted that the point did not require further consideration in the present appeal.
Caroline Addy, instructed by White & Case LLP, represented Facebook UK Limited
David Glen, instructed by Pinsent Masons LLP, represented Google UK Limited
The judgment is available here.