The Court of Appeal Extends Territorial Reach of GDPR to Overseas Companies Offering Subscription Services – Including News Journalism
In Soriano v Forensic News LLC & Ors [2021] EWCA Civ 1952, the English Court of Appeal allowed the Claimant’s cross-appeal to serve his data protection claim against news organisations and journalists outside the jurisdiction (in the USA). In allowing the appeal, the appellate Court found that Forensic News was established in the UK/EU with subscriptions via the Patreon platform demonstrating a ‘stable arrangement.’
Lord Justice Warby said that “[T]he offer and acceptance of subscriptions in these local currencies is arguably a ‘real and effective’ activity that is ‘oriented’ towards the UK and EU.” The Court found that Forensic’s website offered a ‘service’ to UK and EU readers that was related to the journalistic processing of personal data. The decision is likely to have far-reaching consequences, as it confirms a company anywhere in the world that offers subscriptions in pounds sterling or euros can be sued under the GDPR even if there is no other EU legal presence.
Background
The Claimant Mr. Soriano, holds dual British and Israeli citizenship and resides in the UK. The Defendants included Forensic News, an investigative journalism website based in California, its owner, and several journalists who had written for the website. Mr. Soriano sought to bring various claims against the Defendants in relation to ten internet publications and various social media postings including on Facebook and on Twitter, which had had made various allegations against Mr. Soriano’s political connections and financial affairs, claiming they are defamatory.
Only some claims related to data protection, the other claims are in relation to malicious falsehood, libel, harassment and misuse of private information. As all of the Defendants are domiciled in the U.S., Mr. Soriano sought the permission of the High Court to serve his claims out of the jurisdiction. In summary, the High Court found that the processing of personal data in this case was outside the jurisdictional scope of the GDPR, as summarised in our earlier article that can be found here. The Defendant’s appeal challenged the grant of permission to serve the libel claim, whilst Mr. Soriano cross- appealed the High Court’s ruling on the jurisdictional scope of the GDPR.
The Court of Appeal dismissed the appeal against the High Court’s decision on the libel claim and malicious falsehood claims, but allowed the cross-appeal against the High Court’s decision on the GDPR claim. Therefore, Mr. Soriano’s case against Forensic will now proceed on libel and data protection grounds. Our focus here is on the Claimant’s (Respondent’s) cross-appeal in relation to the territorial reach of the GDPR.
The Decision of the Court of Appeal
Jurisdiction – Article 79(2)
In the High Court proceedings, Mr. Soriano relied upon Article 79(2) of the GDPR as an alternative jurisdictional gateway to serve his claim outside the jurisdiction. Article 79(2) of the GDPR states that a claimant may bring a claim either in the Member State where the data controller or processor has an establishment, or in the Courts of the Member State where the claimant has their habitual residence.
Whilst the High Court held that Mr. Soriano satisfied the habitual residence limb of Article 79(2), the lower Court considered the merits of his claim, and found that the Claimant had not demonstrated a real prospect of showing that his claims fell within the scope of the GDPR, as defined by Article 3 as discussed below. This point on establishment is very important for those dealing in data because the level of activity required to have an establishment may be seen differently in different states.
Establishment – Article 3(1)
Article 3(1) applies to the processing of personal data in the context of (emphasis added) the activities of an establishment of a controller or a processor in the EU, regardless of whether the processing takes place in the EU or not.
The High Court considered decisions of the Court of Justice of the European Union (CJEU) that tell us that for an establishment to exist there must be ‘real and effective activity’ exercised through ‘stable arrangements.’ Naturally those terms can be interpreted and argued over, and so this case is helpful to understanding at least the English view. In this case, the judge in the lower Court considered that the Claimant had fallen short of meeting the test for establishment under Article 3(1), but the Appeal Court view differed.
The Court of Appeal view given by Lord Justice Warby considered the CJEU authorities on the meaning of ‘establishment’ in Article 4 of the GDPR’s predecessor, the Data Protection Directive 95/46, were met here. Lord Justice Warby finding it arguable that the Defendants had an establishment on the evidence before the court, as the CJEU authorities had set a low bar and that the Claimant merely had to “persuade the Court that it is not fanciful to think that this case crosses that low bar.”
Lord Justice Warby found that the Defendants intended to make their output available in the UK and EU and succeeded in attracting more than minimal readership. A key factor in the Judge’s decision was the fact that the Defendants expressly solicited subscriptions from the UK and the EU via the Patreon platform: Lord Justice Warby stated that; “[T]he key issue under Article 3(1), as I see it, is whether the creation and use of the Patreon subscription facility demonstrates ‘stable arrangements.”
The lower Court Judge found that the Patreon arrangements were not ‘stable’ as they could be cancelled by subscribers at any time. Whilst noting that the CJEU authorities provide no criteria for deciding whether a given arrangement is ‘stable.’ Lord Justice Warby took the view that it is important to consider what actually happens rather than what subscribers can do in principle. In the his view in the context of this particular online media publication, subscription arrangements of this kind should be viewed as stable in nature and that once subscriptions are established they tend to be maintained. In reaching this conclusion, the Judge considered that subscriptions are a major income stream, contributing some 85% of total income.
Territorial reach of the GDPR – Article 3(2)
Article 3(2) extends the territorial reach of the GDPR in relation to the processing of personal data of data subjects in the EU by a controller or processor not established in the EU, where the processing activities are related to (emphasis added):
(a) Offering goods and services, irrespective of whether a payment of the data subject is required, to data subjects in the Union; or
(b) Monitoring the behaviour of data subjects to the extent that the behaviour takes place within the EU.
Offering of Goods or Services – Article 3(2)(a)
Whilst the High Court held that there was nothing to suggest that Forensic News was targeting the UK as regards the goods and services it offers, the Court of Appeal did not agree. Mr. Soriano’s grounds of appeal argued that Article 3(2)(a) was satisfied on the basis that the maintenance of the website offering goods and services to data subjects in the UK and EU and the journalistic processing of the claimant’s personal data were ‘related to’ one another. Lord Justice Warby agreed as the journalistic processing complained of is ‘related to’ an offer made by the Defendants to data subjects in the UK/EU to provide them with services in the form of journalistic output.
Monitoring or Profiling – Article 3(2)(b)
The Court of Appeal also overturned the finding of the High Court that Forensic News was not ‘monitoring’ Mr. Soriano’s behaviour in the EU in accordance with Article 3(2)(b). Lord Justice Warby did not consider that the mere publication of articles containing the Claimant’s personal data was necessarily a form of monitoring within Article 3(2)(b). However, the Judge held that collecting information about the behaviour in the EU of an individual who is in the EU, assembling, analysing, and ordering that information for the purposes of writing and publishing an article about that behaviour in the EU is ‘monitoring’ within Article 3(2)(b). Furthermore, Lord Justice Warby stated that the Defendants’ activity falls within the scope of the European Data Protection Board’s (EDPB) notions of “behavioural analysis and profiling.”
Comment
This is an important decision on many levels and the first time an English appellate court has considered the territorial reach of the GDPR. It also shows the ongoing relevance of the EU law to understanding GDPR, which has been retained in UK legislation post-Brexit (now properly called the UK-GDPR). The judgment aligns with concerns we have raised before that the scope of the law is broad and all those doing business wherever they are based should keep it in mind. It confirms that companies anywhere in the world that offer Patreon subscriptions in pound sterling are doing enough to then be subject to the UK GDPR, even if they have only a minimal number of subscribers in the UK/EU, as was the case here. Lord Justice Warby confirming the low bar on establishment and jurisdiction from EU decisions applies for matters under the UK GDPR, even where the activity was ‘minimal.’
Lord Justice Warby recognised that his judgement is likely to have far-reaching effects as he stated that “as these issues will, so it seems, need further and definitive consideration in this case it seems to me that the Information Commissioner should be invited to consider intervening to assist the Court.” Although at the time of writing the ICO has not commented on the issues raised by this case, the targeting, monitoring and the general use of cookies is of ongoing concern to regulators, and so we can expect this to be further explored by regulators in the future. A new listening exercise has just been launched by the UK Information Commissioner, and the UK has launched a new panel looking at cross border data transfers, so there is scope for further consideration in the near future of related aspects of the extent of jurisdiction.
It has been reported that the Defendant’s intend to seek permission to appeal to the Supreme Court and if that happens we will monitor developments and provide updates in due course.
A copy of the Court of Appeal’s decision can be found here.
A copy of the High Court’s decision appealed can be found here.
For more information please contact Partner, James Tumbridge at jtumbridge@vennershipley.co.uk.
