Ordanduu GmbH & Anor, R (On the Application Of) v Phonepayplus Ltd

A regulator applying a domestic code to an information society service established in another Member State must comply with the country-of-origin principle and the strict conditions for derogation in Article 3 of the Directive 2000/31/EC on Electronic Commerce. The derogation must be necessary, directed to a serious and grave risk, proportionate, and limited to the particular service concerned. The regulator must also act fairly. Where an investigation has been completed, fairness may require disclosure of the material allegations and an opportunity to respond before an emergency procedure is authorised, especially where suspension and withholding of revenue will seriously affect the business. The public authority bears the burden of justification and must use the least restrictive means achieving consumer protection.

Two German companies providing online prize quiz services challenged decisions by PhonepayPlus following the use of ransomware by an affiliate marketer to promote some of their services. PhonepayPlus invoked its Emergency procedure, suspended the companies’ UK business, withheld revenues and later imposed sanctions under its Code.

The claim alleged unfairness, disproportionality and breach of Article 3 of the Directive 2000/31/EC on Electronic Commerce, as implemented by the Electronic Commerce (EC Directive) Regulations 2002. The central issues were whether the Emergency procedure could lawfully be applied without prior representations, whether the measures were proportionate, and whether the Commission’s subsequent view affected the court’s assessment.

1. Claim allowed in substance. The Defendant’s actions were unlawful and the claim was transferred to the Queen’s Bench Division for causation and quantification of damages.
2. Because the Claimants were established in Germany, the country-of-origin principle in Article 3 of the Directive 2000/31/EC on Electronic Commerce applied. Any derogation required strict compliance with Article 3(4), or the urgency exception in Article 3(5). The Defendant had to show that the measures were necessary for consumer protection, addressed a given service presenting a serious and grave risk of prejudice, and were proportionate.
3. Fairness required the Defendant, after its nine-day investigation, to disclose the report or the essence of the allegations and allow the Claimants to make representations before seeking authorisation for the Emergency procedure. The procedure was analogous to an ex parte application. The Defendant therefore owed a duty of full and frank disclosure of material facts, including the absence of consumer complaints, the isolated nature of the rogue affiliate, the steps already taken to block the website, and the true scope of the proposed suspension.
4. The opportunity to seek review after suspension did not cure the unfairness. By then the Claimants’ business had been suspended and revenues withheld, and the review process wrongly placed on them the burden of establishing that no consumer harm was or would be caused.
5. The measures were disproportionate. The Defendant had not produced precise evidence of actual consumer harm or established a sufficient risk of potential harm in relation to the affected services. Article 3(4) did not permit use of the Emergency procedure against unaffected services or existing customers. Less restrictive measures, including a targeted suspension or restrictions on affiliate marketing, were available.
6. The Commission’s later confirmation did not assist the Defendant because it was based on materially inaccurate and incomplete information supplied by it. The breach was sufficiently serious for an EU-law damages claim. Causation and quantification were remitted to the Queen’s Bench Division.

First-instance judicial review proceedings. The judgment records that Charles J granted permission to apply for judicial review on 3 April 2014. No appellate decision is stated.