CG v Facebook Ireland Ltd & Anor

Factual and Procedural Background

This case concerns the liability in damages of information society services, specifically Facebook, for misuse of private information resulting from third-party postings on its social network. The Defendants/Appellants, Facebook Ireland Ltd ("Facebook") and an individual ("McCloskey"), appealed an order holding Facebook liable for misuse of private information related to three profile pages and comments, and McCloskey liable for unlawful harassment relating to the first profile page. The trial judge awarded damages and ordered Facebook to terminate one profile page and prohibited McCloskey from harassing the Plaintiff. The Plaintiff cross-appealed, arguing that Facebook should be liable as a data controller under the Data Protection Act 1998 ("the 1998 Act") due to its economic activity and presence in the United Kingdom. McCloskey did not pursue his appeal, which was dismissed. Both Facebook and the Plaintiff appealed damages levels but did not pursue those appeals at hearing.

The factual background involves three Facebook profile pages created by McCloskey targeting convicted sex offenders, including the Plaintiff. The pages were publicly accessible without privacy settings, attracting numerous hostile and threatening comments. The Plaintiff issued proceedings seeking injunctions and damages, with interim relief granted to remove one page. Despite removal orders, new pages were created and material reposted. The Plaintiff’s solicitors repeatedly requested removal of defamatory and threatening content, but Facebook required specific URLs for each offending post to act. Facebook took down material after receiving these URLs. The Plaintiff suffered anxiety and adverse effects on family life due to the postings. The trial judge found McCloskey harassed the Plaintiff and Facebook liable for misuse of private information. The case also involved consideration of Facebook’s corporate structure, data control responsibilities, and applicability of the e-Commerce Directive and associated UK regulations.

Legal Issues Presented

1. Whether Facebook, as an information society service provider, is liable in damages for misuse of private information arising from third-party postings on its platform.
2. Whether Facebook qualifies as a data controller established in the United Kingdom under section 5 of the Data Protection Act 1998, thereby subjecting it to UK data protection law.
3. The extent of Facebook’s actual knowledge or awareness of unlawful activity or information under the e-Commerce Directive and the Electronic Commerce (EC Directive) Regulations 2002, and whether it acted expeditiously to remove unlawful content.
4. The application and scope of the tort of misuse of private information in the context of online postings and the reasonable expectation of privacy of a convicted offender.
5. The relationship between the Protection from Harassment (Northern Ireland) Order 1997 and the tort of misuse of private information in providing protection against unlawful conduct.

Arguments of the Parties

Appellants' Arguments

• Facebook contended that the principal content complained of was already in the public domain, originating from a press article reporting the Plaintiff’s convictions.
• They argued that the trial judge erred in relying on categories of sensitive personal data under the 1998 Act to determine privacy expectations.
• Facebook accepted only the publication of the Plaintiff’s present address as private information, disputing that a general area of residence warranted privacy protection.
• They asserted that the e-Commerce Directive and 2002 Regulations exempted them from liability absent actual knowledge of unlawful content, which they claimed was not established due to insufficiently precise notification.
• Facebook maintained that the correspondence from the Plaintiff did not provide adequate notice to fix them with actual knowledge of unlawful activity.
• They argued the trial judge’s inference that Facebook had constructive knowledge and a monitoring obligation was inconsistent with the e-Commerce Directive’s prohibition on general monitoring obligations.
• Regarding data protection, Facebook argued that it was established in Ireland, not the UK, and that its UK subsidiary merely provided marketing support without operating or controlling the Facebook service.
• They relied on case law to support a restrictive interpretation of "establishment" under the 1998 Act and EU directives.

Respondent's Arguments

• The Plaintiff submitted that the reasonable expectation of privacy should be assessed broadly, including consideration of sensitive personal data categories under the 1998 Act.
• They emphasized the intrusive nature of photographs and the context of harassment and threats in assessing privacy expectations.
• The Plaintiff argued that Facebook had actual knowledge of unlawful activity through prior litigation and correspondence, and that Facebook was aware, or ought to have been aware, of McCloskey’s activities and the content on the profile pages.
• They contended that Facebook’s UK subsidiary engaged in real and effective activity in the UK, making Facebook a data controller established in the UK under section 5 of the 1998 Act.
• The Plaintiff relied on EU case law, particularly Google Spain and Weltimmo, to support a broad interpretation of establishment and jurisdiction for data protection purposes.
• They submitted that the tort of misuse of private information protects personal autonomy and dignity, and that the cumulative publication of information about the Plaintiff constituted unlawful intrusion.
• The Plaintiff asserted that Facebook failed to act expeditiously to remove unlawful content once it had knowledge or awareness of it.

Table of Precedents Cited

Court's Reasoning and Analysis

The court began by affirming the trial judge’s finding that McCloskey’s conduct amounted to unlawful harassment of the Plaintiff. It distinguished the protections under the Protection from Harassment (Northern Ireland) Order 1997 from the tort of misuse of private information, noting their complementary but distinct roles in protecting personal autonomy and dignity.

Applying established privacy law principles, the court accepted the objective test for reasonable expectation of privacy, considering all circumstances including the sensitive nature of data under the 1998 Act. It found that while the Plaintiff’s convictions and name were public information, the cumulative publication of his photograph, name, convictions, and information about his residence in the context of harassment constituted private information, given the risk of harm and intrusion into his family life.

The court scrutinized Facebook’s knowledge under the e-Commerce Directive and 2002 Regulations. It rejected the trial judge’s inference that Facebook had constructive knowledge or a monitoring obligation, emphasizing that the Directive prohibits general monitoring duties. The court held that actual knowledge or awareness of unlawful information must be based on clear, specific notification.

Regarding the correspondence received by Facebook, the court found it insufficiently precise to establish actual knowledge of misuse of private information, as it focused on defamation and threats rather than privacy concerns. The Plaintiff’s failure to use Facebook’s online reporting tools further limited Facebook’s knowledge. However, the court identified that on 26 November 2013, when specific URLs were provided relating to the Plaintiff’s location, Facebook acquired knowledge sufficient to trigger liability, as it did not act expeditiously to remove the material until 4/5 December 2013.

On the data protection issue, the court analyzed whether Facebook was established in the UK under section 5 of the 1998 Act, considering EU jurisprudence (Google Spain and Weltimmo). It concluded that Facebook UK Ltd’s real and effective activities in marketing and data processing constituted stable arrangements in the UK, making Facebook a data controller established in the UK. This broadened Facebook’s data protection obligations under UK law.

Finally, the court held that the e-Commerce Directive and 2002 Regulations provide an exemption from damages liability for information society service providers absent actual knowledge or awareness of unlawfulness and failure to act expeditiously. The court determined that Facebook was liable for misuse of private information only for the period after it acquired such knowledge on 26 November 2013 until removal of the content.

Holding and Implications

The court’s final decision was to allow Facebook’s appeal in part and the Plaintiff’s cross-appeal in part. Specifically, it held that Facebook is liable in damages for misuse of private information from 26 November 2013 until 4/5 December 2013 in respect of certain postings. The court affirmed that Facebook is a data controller established in the United Kingdom under section 5 of the Data Protection Act 1998.

The court also held that Facebook is entitled to the protection of the e-Commerce (EC Directive) Regulations 2002 against claims for damages under the 1998 Act for periods before 26 November 2013, due to lack of actual knowledge or awareness of unlawful content. The injunction against Facebook and McCloskey remains in place.

The decision clarifies the application of the e-Commerce Directive’s notice and take down regime, emphasizing the necessity of specific notification to fix liability on information society service providers. It also affirms a broad interpretation of establishment for data protection purposes, extending UK data protection jurisdiction to entities with effective and real activities in the UK, even if incorporated elsewhere. No new precedent was set beyond these determinations, and the court reserved further consideration of remedies and costs.