Soriano v Forensic News LLC & ors [2021]

Introduction

The recent UK case of Soriano v Forensic News and Others has become the first appellate decision to test the territorial reach of Article 3 under the General Data Protection Regulation (“GDPR”).

Walter Soriano sought the court’s permission under the UK Civil Procedure Rules to serve against the news organisation and journalists, who were all domiciled in the US. The Court of Appeal looked at all the claims and unanimously allowed the claimant’s appeal to serve his data protection claim against the US defendants – a decision which will have far-reaching implications for media corporations.

The judgment will also act as appellate authority on s.9 Defamation Act 2013 after the Court of Appeal’s decision regarding a concurrent libel claim. The court held that section 9 was a modification of the usual forum test and that Parliament had not introduced a new form of jurisdictional bar.

Background

The claimant, Walter Soriano, is a businessman with dual citizenship in both the UK and Israel. The defendants included Forensic News, a US-based investigative journalism website, its owner and several journalists who contributed to the website.

Between 5 June 2019 and 16 June 2020, a series of eight publications appeared on Forensic News outlets providing a ‘sustained assault’ on the claimant and his reputation. There were two further publications referring to the claimant on a website said to be operated by the sixth defendant. In addition, there were 432 tweets and Facebook posts that referred to the publications complained of.

The claimant sued for libel, misuse of private information, breach of data protection, harassment, and malicious falsehood. As the defendants were domiciled in the US, none of these claims could be brought against any of them unless the court gave permission to serve them outside of the jurisdiction, pursuant to Part 6 of the Civil Procedure Rules.

The claimant issued an application for permission. Such applications are normally determined without notice to the defendant under CPR 23.9. If permission is granted, the defendant may apply to set it aside. On 30 September 2020, Nicklin J ordered that the application notice and supporting evidence be served on the defendants due to the complexity of the application, while also recognising that if permission were to be granted on an ex parte basis there was a real prospect that the defendants would apply to set it aside anyway. The defendants did serve evidence and opposed the application.

On 21 January 2021, after a contested hearing, Jay J gave permission in respect of the libel claims and the misuse of private information claim in respect of photographs only but refused permission for all the other claims to be served out the jurisdiction. The defendants appealed against this decision contending that the Judge was wrong to grant permission for any of the claims. The claimant, supporting the Judge’s decision, cross-appealed, arguing that he should have been allowed to pursue all of the claims including the claims in data protection and malicious falsehood.

Court of Appeal

Lord Justice Warby, with the agreement of Lady Laing and Dame Sharp, dismissed the appeal against the Judge’s decision on the libel claim and the misuse of private information claim so these actions could proceed. The Court of Appeal also denied the cross-appeal against the Judge’s decision on the malicious falsehood claim but did allow the cross-appeal against the Judge’s decision on the GDPR claim.

The Law on Service outside the jurisdiction

The court can only give permission to serve a claim on a defendant outside the jurisdiction if it meets three requirements:

(1) The claim is of a kind that falls within one of the “gateways” set out in CPR Practice Direction 6B (“the Gateway Requirement”).

(2) The claimant must satisfy the court that he has a real as opposed to a fanciful prospect of success on the claim (“the Merits Test”).

(3) The court will not give permission unless it is satisfied that England and Wales is the proper place in which to bring the claim: CPR 6.37(3) (“the Forum Test”).

The cross-appeal data protection claim

Jay J accepted the claimant’s case on the Gateway Requirement under Article 79(2) of the GDPR. He would also have held that these claims satisfied the general Forum Test, with the courts of England and Wales being the right place to bring any such claim. However, he held that the claims failed the Merits Test.

In order to have a viable claim under the GDPR, the claimant needed to establish that the publication of his personal data fell within the territorial scope of the GDPR under either Article 3(1) or Article 3(2). Jay J ruled that the claimant had failed to demonstrate a real prospect of showing that his claims fell within the territorial scope of the GDPR, as defined by Article 3 and therefore, the claimant was unable to pass the Merits Test. This decision has now been overturned by the Court of Appeal.

Article 3(1) of the GDPR applies to:

"the processing of personal data in the context of the activities of an establishment of a controller or processor in the Union, regardless of whether processing takes place in the Union or not".

The concept of "establishment" was considered by the Court of Justice of the European Union which confirmed that it should be interpreted very broadly. It ruled that "any real and effective activity – even a minimal one" via "stable arrangements" in the EEA would be sufficient to qualify as an establishment under European data protection law.

On a proper construction of Article 3(1) GDPR, the Court of Appeal decided that there was an arguable case that the defendants were ‘established’ in the UK/EU through the limited number of UK/EU subscriptions and readership. The Court of Appeal held that subscriptions to the Forensic News website through the Patreon platform were a consistent source of income for Forensic News and should therefore be viewed as a stable arrangement.

Under Article 3(2) the GDPR applies to:

"the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to (a) the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union, or (b) the monitoring of their behaviour as far as their behaviour takes place within the Union".

The court decided that on a proper construction of Article 3(2)(a) GDPR, there was an arguable case that the defendants’ journalistic processing was ‘related to’ the offering of goods and services in the UK/EU. The court came to this conclusion citing the journalistic processing complained of being related to an offer being made by the defendants to data subjects in the UK/EU to provide them with services in the form of journalistic output.

The court decided that on a proper construction of Article 3(2)(b) GDPR, there was an arguable case that defendants’ journalistic processing was ‘related to monitoring’ of C’s behaviour in the UK/EU and these activities would fall within the scope of the European Data Protection Board’s notions of ‘behavioural analysis and profiling’. The assembly, analysis, sorting and reconfiguration of the claimant’s personal data resulting in publication could arguably constitute ‘monitoring’. An example of this was seen when the defendant assembled and published an article entitled ‘The Walter Soriano files”.

Having delivered this judgment, Lord Justice Warby was keen to stress that that these issues will need further and definitive consideration, and that he would support the intervention of the Information Commissioner to help assist the court.

The cross-appeal libel claim

Jay J had recognised that the libel claim satisfied the Gateway Requirement, as the claim fell within PD6B 3.1(2) and 3.1(9), and it was also accepted that the Merits Test had been met. The issue for the Court of Appeal was whether the courts of this jurisdiction was clearly the most appropriate forum for the trial of the libel claim, applying s 9 of the 2013 Act and the general Forum Test.

The court found that the requirement it introduced for the court to be satisfied that England is the ‘most appropriate place to hear a libel dispute’ (s9 Defamation Act 2013) is simply an added extra to the usual regime which applies where a claimant needs permission to serve outside of the jurisdiction (or where a defendant who is served in England challenges the court’s jurisdiction). The usual rules as to burden and standard of proof for such applications will continue to apply.

Therefore, in order to obtain permission to serve outside of the jurisdiction for libel claims, a claimant must generally establish that: the claim falls within a jurisdictional ‘gateway’ in the CPR; there is a real as opposed to fanciful prospect of success; and England and Wales is the proper place in which to bring the action (as discussed above). In libel cases, if the defendant is not UK-domiciled, under s.9, a claim against a foreign defendant can only proceed where the court is satisfied that England is, of all the places in which the statement complained of has been published, ‘clearly the most appropriate place in which to bring the action in respect of the statement’.

Consequently, Jay J’s decision to allow service out of the jurisdiction was the correct one. Despite, the claimant’s overseas business interests and Israeli heritage; he was a British citizen, domiciled in the U.K. and with reputation centred in this jurisdiction, who received defamatory allegations on a huge scale from the defendants.

In rejecting the proposition that the defendants be tried in California, the court confirmed that s.9 challenges should be raised in accordance with CPR Part 11 in the usual way. CPR Part 11 provides a mechanism for making a forum challenge in such a case. The defendants failed to offer substantial evidence that would lead to them being tried in California. The court noted that the defendants must bear the evidential burden in establishing that another jurisdiction is as suitable as England and Wales to hear the claim. The standard of proof required would be the well-established standard for forum disputes, of a ‘good arguable case’, contrary to the Court of Appeal’s decision in Wright v Ver.

Comment

As there is no authority that assists directly on the meaning and effect of Article 3(1), and only the European Data Protection Board’s guidelines to help the courts with Article 3(2), this decision will act as the authority judgment regarding the territorial applicability of the GDPR under Article 3.

If a media company has even minimal commercial activity in the UK this arguably amounts to an ‘establishment’, and it may be subject to the GDPR regime. While under Articles 3(2)(a) and (b) of the GDPR, a website offering a ‘service’ to UK/EU readers relating to journalistic processing of data and the assembly, analysis and sorting of the claimant’s personal data, arguably constitutes ‘monitoring’.

The claimant’s solicitor, Shlomo Rechtschaffen, views the decision as having ‘historic importance to all US media: if you publish an article about a UK citizen, even if you are physically only based in the US, you may be sued in the UK for breach of data protection laws’.

The ruling certainly points to increased protection for UK citizens of their reputation and personal data against foreign publishers. However, concerns remain that the low threshold set by the court’s decision may have far-reaching and potentially unintended consequences. The decision allows companies anywhere in the world offering minimal Patreon subscriptions to UK/EU subscribers to be subject to EU data protection laws.

Indeed, it seems that Lord Justice Warby himself was uneasy by the potential consequences of the judgment by signalling that the issues decided ‘need further and definitive consideration in this case’ and his suggestion that the Information Commissioner should be invited to intervene.

Additionally, in relation to libel claims, the judgment provided useful clarification on s.9. of the Defamation Act. The court held that s.9 contained ‘important modifications’ to the Forum Test but did not have ‘a more far-reaching change in the law’ which created a ‘jurisdictional bar which the claimant must overcome’.

The decision is important in rejecting an interpretation which would have put onerous obligations onto the claimant. Nevertheless, claimants based abroad and those with a global reputation will still face a potentially difficult and expensive task in persuading the court that the jurisdiction of England and Wales is a suitable place for their libel claim to be heard.