Sabados v Facebook Ireland Ltd

For Norwich Pharmacal purposes, England and Wales may be an arguable place of damage where a claimant suffers distress here from the alleged destruction or misuse of personal data, even though the relevant acts occurred elsewhere. The court must consider whether there is arguable wrongdoing, whether disclosure is necessary to identify or sue the wrongdoer, and whether the respondent is sufficiently mixed up in the wrongdoing and can provide the information. Relief remains discretionary, with privacy and data-protection rights capable of protection through appropriate undertakings.

The claimant sought a Norwich Pharmacal order against Facebook Ireland to identify the person who had requested deletion of a deceased man's Facebook account. The deletion allegedly destroyed photographs and private messages containing the claimant's personal data and may have involved access to confidential communications. Facebook was domiciled in Ireland, did not acknowledge service, and was not represented at the hearing.

The central issues were whether the English court had jurisdiction under Article 7(2) of the Brussels Recast Regulation and whether the requirements for Norwich Pharmacal relief were satisfied.

1. Jurisdiction. The claimant had an arguable case that England and Wales was the place where damage occurred for Article 7(2) of the Brussels Recast Regulation. The alleged conduct occurred principally in Ireland and possibly Bosnia, but the claimant's grave distress was suffered in England. The judge recognised the difficulty of founding jurisdiction on distress alone and distinguished internet-publication cases involving a claimant's centre of interests.
2. Norwich Pharmacal conditions. Applying the summary in Ramilos Trading Ltd v Buyanovsky [2016] EWHC 3175 (Comm), there was a good arguable case that an unknown person had procured deletion of the account and had possibly accessed private communications, giving rise in principle to claims involving data protection, misuse of private information and breach of confidence. The information sought was necessary to identify the person and formulate proceedings. Facebook was more than a mere witness: it had hosted the information, processed the deletion request and was likely to hold details identifying the requester.
3. Discretion. The remedy is directed to doing justice and remained appropriate because, without disclosure, the claimant would have no remedy against the unknown person. The court could protect the person's Article 8 rights and data-protection rights through undertakings restricting use of the information to proceedings, together with any further safeguards required.
4. The Norwich Pharmacal order was made.