In the recent decision of Soriano v Forensic News LLC and others,^[1] the Court of Appeal has considered the meaning of the jurisdictional tests contained in section 9 of the Defamation Act 2013 (the “Defamation Act”) and the General Data Protection Regulation (“GDPR”), in the context of an appeal and cross-appeal concerning the claimant’s application to serve claims for libel, misuse of private information, breach of GDPR and malicious falsehood outside of the jurisdiction.

In relation to the claimant’s libel claim, the Court has provided helpful clarification on the nature of section 9 of the Defamation Act, which governs the jurisdiction of the courts of England and Wales to hear a libel claim, holding that it is simply a modification to the common law rules rather than a unique parallel regime. This will be welcomed by prospective claimants, who otherwise faced onerous obligations under the section 9 regime, although it will still be necessary for claimants based abroad or with a “global reputation” to persuade the Court that England and Wales is clearly the appropriate place for the claim to be tried.

The judgment also considers the GDPR’s extra-territorial reach, particularly in respect of foreign websites, and is the first appellate decision on Article 3 GDPR. Interestingly, the Court of Appeal disagreed with the High Court as to the merits of the claimant’s GDPR-based claims, holding that it was sufficiently arguable that the claims involved processing by the defendants which fell within the ambit of Article 3 GDPR. The Court of Appeal therefore overturned the High Court’s decision to refuse the claimant permission to serve its GDPR claims out of the jurisdiction. Given the novelty of the arguments raised by the claimant in support of such claims, it will be interesting to see whether they survive a full trial of the merits (should matters get that far), and interested parties will therefore be monitoring this case closely as it proceeds.

Background

In brief overview, the claimant in this matter, Walter Soriano, is a businessman and British citizen. The first defendant is the California corporation that owns and operates the publication, Forensic News, which operates via a website, Twitter, Facebook and podcasts. The individual defendants in this case are all associated with Forensic News and are all domiciled in the United States. Between June 2019 and June 2020, a series of eight publications appeared on Forensic News which referred to the claimant in unflattering terms, including photographs of him which he claims were stolen from social media accounts. There were also some 432 tweets and Facebook posts that referred to the complained-of publications. The allegations made by Forensic News include that the claimant is the “thug” of the Prime Minister of Israel, has close and corrupt links to the Russian State, is guilty of multiple homicides, has received illegal kickbacks and is otherwise involved in money laundering and other corrupt practices.

The claimant issued proceedings in June 2020, making claims under the laws of libel, misuse of private information (“MOPI”), data protection, malicious falsehood, and harassment, and sought permission to serve proceedings on the defendants out of the jurisdiction. At first instance, the High Court granted permission to serve the claims in libel and some of the MOPI claims on the first five defendants out of the jurisdiction. Permission was refused in respect of the bulk of the claims in MOPI, the claims in data protection, and the claims in malicious falsehood and harassment. For more information regarding the first instance decision, please refer to the January 2021 edition of our litigation blog, PHlit.

The first to fifth defendants appealed against that decision, and permission was also granted for the claimant to cross-appeal the decision that its claims in data protection and malicious falsehood could not proceed.

The appeal

In approaching the appeal, the Court of Appeal began by considering the well-established principles for service out of the jurisdiction. In particular:

• The claim must be of a kind that falls within one of the “gateways” set out in CPR Practice Direction 6B (the “Gateway Requirement”). On this question, the claimant has to satisfy the Court that it has a good arguable case.
• The claimant must also satisfy the Court that it has a real, as opposed to “fanciful”, prospect of success (the “Merits Test”).
• The Court will not give permission unless it is satisfied that England and Wales is the proper place in which to bring the claim (the “Forum Test”). This is normally resolved by reference to the principles set out in the leading House of Lords authority on forum conveniens, Spiliada Maritime Corp v Cansulex Ltd [1987] AC 460, in which it was held that the question is whether this jurisdiction is “clearly or distinctly” the most appropriate in which to try the action in the interests of all the parties and the ends of justice.
• A claimant seeking permission to serve out of the jurisdiction always bears the legal burden of proof on all these issues. However, a defendant who is challenging an order for permission to serve out of the jurisdiction needs to identify some other appropriate forum which would have jurisdiction over the claim.

The Court then turned to consider each of the four causes of action raised in these proceedings.

Cause of Action 1: The libel claim

The Court began by noting that the relative simplicity of the tort of libel in English law had, over the years, given rise to “libel tourism”, in which libel claims were brought in England by and against foreigners with relatively limited connections with the jurisdiction. In order to deal with this perceived problem, section 9 of the Defamation Act was enacted, which provides that “a court does not have jurisdiction . . . unless the court is satisfied that, of all the places in which the statement complained of has been published, England and Wales is clearly the most appropriate place in which to bring an action in respect of the statement.”

There are relatively few authorities on the application of section 9, but the Court gleaned the following general propositions from the authorities available:

• the claimant bears the burden of satisfying the court that England is the most appropriate place in which to bring the claim;
• “place” for the purposes of the section means jurisdictions in which there has been publication of the statement complained of;
• relevant factors for consideration will include the best evidence to show what all those places are, the number of times the statement has been published in each jurisdiction and the amount of damage to the claimant’s reputation in England and Wales compared with elsewhere;
• other relevant factors are likely to include the availability of fair judicial processes, available remedies, costs of pursuing proceedings and other factors which might impact access to justice (such as the location of witnesses) in the other relevant jurisdictions; and
• this list of factors is non-exhaustive because the question of which is the most “appropriate” jurisdiction will be highly fact-specific to the individual claim, and the court will be required to make the best assessment that it can on the available evidence.

The defendants had conceded that both the Gateway Test and the Merits Test had been met in this case, and so the issues for the High Court had been whether the general Forum Test was met, alongside consideration of section 9 of the Defamation Act. Such issues were determined in the claimant’s favour.

On appeal, the defendants argued that: (i) in considering section 9, the judge was wrong to hold there is an evidential burden on a defendant to show that another forum is available and appropriate; and (ii) having found that the claimant had been far from forthcoming about his international business interests, the judge had no safe basis on which to conclude that England and Wales was the most appropriate place to bring the libel action.

In reaching its decision on the libel action, the Court of Appeal disagreed with the High Court that the section 9 test represented any more than a modification of the forum conveniens test, holding that: “section 9 should not be treated as a fresh standalone provision of unique character but rather as a tailored modification of the established regime”. Accordingly, the standard of proof which a claimant must meet under section 9 is the same as the well-established standard for forum conveniens disputes; that is, a good arguable case. However the Court of Appeal agreed with the High Court that a defendant contesting jurisdiction under section 9 bears an evidential burden as to the reach and extent of the publication and therefore the “places” of publication.

In addition, the Court of Appeal considered that although the judge was mildly dissatisfied with the extent of the claimant’s disclosure as to his foreign business interests, there was enough to enable him to reach a decision and there was no need for the claimant to adduce expert evidence to show that California was a suitable alternative jurisdiction under the section 9 test.

Accordingly, in spite of this disagreement as to the scope and application of the section 9 test, the Court of Appeal did not need to disturb the High Court’s decision granting permission for the claimant to serve its libel claims outside of the jurisdiction.

Cause of Action 2: The MOPI claims

Permission to serve outside of the jurisdiction had been refused at first instance in relation to the majority of the claimant’s MOPI claims, on the basis that they failed the Merits Test. However, permission was granted by the High Court for MOPI claims to proceed in respect of four photographs published by the defendants.

Taken in isolation, a MOPI claim in respect of four photographs would have been too trivial to justify the grant of permission to serve outside of the jurisdiction, but, taken in conjunction with the libel claims, the Court of Appeal found that the High Court was right to exercise its residual discretion to grant permission. In this regard, the decision to grant permission in respect of the MOPI claims concerning the photographs was parasitic on the libel claims and, accordingly, the Court of Appeal upheld the High Court’s original decision to grant permission to serve out in respect of such claims.

Cause of Action 3: The data protection claim

The original data protection claim alleged that the defendants acted in breach of GDPR Article 5(1)(a) (processing must be fair, lawful and satisfy a condition under Article 6), Article 5(1)(d) (data must be accurate), Article 10 (processing of personal data relating to criminal convictions and offences) and Article 44 (international transfers of data).

The Court of Appeal noted that the Court’s jurisdiction to entertain a data protection claim against a defendant based outside England and Wales is determined by reference to the GDPR and the general principles for service out of the jurisdiction outlined above. In this regard, the claim was brought on the basis that the processing complained of by the claimant fell within the ambit of Article 3 of the GDPR, which provides:

1. This Regulation applies to the processing of personal data in the context of activities of an establishment of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.
2. This Regulation applies to the processing of personal data of data subjects who are in the Union by a controller or processor not established in the Union, where the processing activities are related to:

1. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the Union; or
2. the monitoring of their behaviour as far as their behaviour takes place within the Union.

For the processing to come within Article 3(1) GDPR, the data controller or processor must have “establishment” within the EU. Although there is no definitive authority as yet, the term “establishment” has been considered by the Court of Justice of the European Union (“CJEU”) in the context of Article 4(1)(a) of the GDPR’s predecessor, the Data Protection Directive 95/46. Referring to three CJEU decisions on the meaning of the term of “establishment” in that context, the Court of Appeal derived the following general propositions:

• There will be establishment in a state where a subsidiary is involved in “orientating” the controller’s commercial activity towards the inhabitants of that state.
• The question is whether the orientation of the controller’s commercial activity towards a particular state extends to “any real and effective activity—even a minimal one—exercised through stable arrangements” (see, for example, Verein fur Konsumenteninformation v Amazon EU Sarl (Case 191/15) [2017] QB 252 at paragraph 75).
• The court should apply a flexible definition to the concept of establishment.
• Factors to be considered in determining whether or not there was establishment of an online-only business would include the language of the website, whether the website was otherwise targeted at inhabitants of a member state, and whether it has a representative, bank account or letter box in that member state.

On the facts of the present case, the Court of Appeal noted that the Forensic News website enabled subscriptions and donations from the U.K. and EU in local currency, and that 8.9% of readers of the website were located in the EU (with a further 8.95% of unascertained location). On the evidence, the defendants intended to make their output available in the U.K. and EU, and succeeded in doing so.

The Court observed, in this regard, that the offer and acceptance of subscriptions in U.K. and EU local currencies arguably amounts to a “real and effective” activity that is “oriented” towards the U.K. and EU. However, more crucially, it found that that the creation and use of the subscription facility demonstrated “stable arrangements”, noting, in particular, that, on the defendants’ evidence, subscriptions contributed some 85% of Forensic News’ total income, and there was no evidence to suggest that, once established, subscriptions would not generally be maintained. Accordingly, the Court of Appeal disagreed with the findings of the High Court, considering that it was arguable that the defendants had an “establishment” in the EU for the purposes of Article 3(1) GDPR through the exercise of “stable arrangements” in one or more member states. An interesting position to take, some might say, when ordinarily, article 3(2) would be invoked in such instances where an organisation “established” outside the jurisdiction makes a website available to users within.

The Court of Appeal did also consider Article 3(2)(a) and held that it was arguable that the journalistic processing in question was “related to” an offer made by the defendants to data subjects in member states to provide them with services in the form of journalistic output.

For similar reasons, the Court of Appeal held that it was arguable that Article 3(2)(b), concerning the processing of data relating to the monitoring of individuals’ behaviour, was also engaged. In this regard, the Court considered it arguable that someone who uses the internet to collect information about the behaviour of an individual in the EU for the purposes of writing and publishing an article using that information is “monitoring . . . [a] data subject’s behaviour” in the EU for the purposes of Article 3(2)(b) GDPR. It observed that merely creating a collection of personal data relating to a data subject’s behaviour in a member state might not be enough, but in the present case the defendants were alleged to have assembled, analysed, sorted and reconfigured data about the claimant, and then published the results of these activities in articles, including one called “The Walter Soriano files”.

Accordingly, the Court concluded that the arguments made in relation to Article 3(1) and (2) GDPR were not “fanciful”, and allowed the claimant’s appeal on this issue, granting permission to serve the data protection claim outside of the jurisdiction.

Cause of Action 4: The malicious falsehood claim

At common law, a claim in malicious falsehood requires a publication by the defendant about the claimant which: (i) is false; (ii) was published maliciously; and (iii) causes special damage. The Court of Appeal noted that, in particular, proof of malice is notoriously difficult to establish, but that it is nevertheless quite common for a claimant to bring parallel claims in malicious falsehood and defamation.

The Court further noted that section 9 of the Defamation Act does not apply to malicious falsehood claims, and therefore the question of forum conveniens was to be decided on the common law test. At first instance however, it was the Merits Test on which the malicious falsehood claim failed. The Court of Appeal agreed with the High Court’s view that the malicious falsehood claim did not pass the Merits Test, holding that it was trite law that malice is tantamount to dishonesty, and is not to be equated with carelessness, impulsiveness or irrationality in arriving at a belief that the matter published is true. The Court held that the claimant had failed to demonstrate any malice in the publications complained of, finding that its case appeared to confuse unfair or irresponsible publication with malice and was otherwise presented on too frail and tenuous a basis to allow a serious allegation of malice to proceed. Accordingly, the Court of Appeal upheld the High Court’s decision to refuse the claimant permission to serve its claim for malicious falsehood outside of the jurisdiction.

Conclusions

Accordingly, the Court of Appeal held that: (i) the claimant’s permission to serve out of the jurisdiction for the libel claims and limited MOPI claims should stand; (ii) the claimant was additionally granted permission to serve out of the jurisdiction in relation to its data protection claims; and (iii) the claimant was denied permission to proceed with the malicious falsehood claim.

Comment

This decision serves as a reminder of the various factors to consider in determining relevant jurisdictional and merits thresholds, particularly in the context of privacy, data and libel actions where a number of differing legislative regimes apply alongside the common law tests.

In respect of the libel claim, the purpose of the introduction of section 9 was to act as an antidote to so-called “libel tourism”. There have only been a handful of decisions regarding the application of section 9 to date, and so this decision provides useful clarification of a number of important points. It is significant that it rejects the proposition that section 9 imposes onerous obligations on a claimant, with no burden on the defendant to demonstrate the appropriateness of the alternative jurisdictions contended for. Instead, section 9 should be interpreted as merely a modification of the usual regime which applies where a claimant seeks permission to serve outside the jurisdiction and, accordingly, the usual rules as to burden and standard of proof for such applications apply. In particular, the burden still rests on a defendant who is challenging an order for permission to serve out of the jurisdiction to identify some other appropriate forum which would have jurisdiction over the claim.

In respect of the data protection claims, the Court of Appeal was ultimately persuaded that the arguments raised by the claimant were sufficiently arguable to pass the threshold of the Merits Test. However, it is worth remembering that the merits threshold in applications for permission to serve out of the jurisdiction is significantly lower than the threshold the arguments will need to ultimately pass at trial if the claimant is to succeed in his data protection claims. The issues considered by the Court of Appeal are novel and, at this stage, have only been analysed at a high level. In this regard, the Court of Appeal’s analysis is undoubtedly unusual and, at times, tenuous. The Court noted that these issues will need further and definitive consideration in due course and invited the Information Commissioner’s Office to consider intervening in this case to assist.