The recent UK case by Soriano against Forensic News and Others examined the territorial scope of the General Data Protection Regulation (“GDPR”) and is the first UK judgment to address the territorial scope of the GDPR. This was a “service-out” case in which the plaintiff, Walter T. Soriano, sought permission from the court under UK civil procedure rules to serve trial on the defendants, all of whom were US residents
The defendants included Forensic News, a US-based investigative journalism website, its owners and a number of journalists who contributed to the website. Mr Soriano’s complaint related to ten internet publications and various social media posts, including on Facebook and Twitter, posted by Forensic News on a variety of topics including former President Trump’s financial affairs and the activities of the Psy Group, one private Israeli intelligence company in Ukraine allegedly linked to Mr. Soriano. The judgment found that the various articles and publications “raise extremely grave allegations against the Claimant” and “constitute an ongoing assault on the Claimant and his reputation”.
Mr Soriano attempted various claims against the defendants, including under the GDPR, for malicious falsehood, harassment, misuse of private information and defamation. Since the defendants were US residents, Mr. Soriano sought permission from the court to settle these claims.
The data protection claim
Before assessing the territorial application of GDPR under Article 3, the Court first had to examine Article 79 (2) of the GDPR to determine whether Mr Soriano was entitled to bring a GDPR action in the UK at all. For this purpose, Article 79 (2) of the GDPR states: “… can be sued in the courts of the Member State in which the person concerned has their habitual residence …”.
Since Mr Soriano was ordinarily resident in the UK since 2003 and a UK national since 2009, he met the criteria under Article 79 (2) to be able to make his claim in the UK. The judgment also states: “The GDPR policy provides that someone habitually resident in a Member State should be able to sue there rather than anywhere else. This also applies if the controller or processor has a branch elsewhere. “As a rule, the applicant has to prove that he has a“ good case ”to serve a claim outside the jurisdiction. While this was relevant to Mr Soriano’s other claims, it was not taken into account for the purposes of his data protection claim, as Article 79 (2) of the GDPR provided an alternative jurisdiction gate for filing a lawsuit. In addition, Article 79 (2) set a lower standard of evidence for Mr Soriano and the Court found that there was no argument that he was not habitually resident in the UK.
After the court found that Mr Soriano could bring his lawsuit in the UK, the court examined the merits of his lawsuit. In order to have a viable claim under the GDPR, Mr. Soriano had to prove that the publication of his personal data falls within the territorial scope of the GDPR in accordance with Article 3 Paragraph 1 or Article 3 Paragraph 2.
Article 3 Paragraph 1 – Establishment
According to Article 3 (1), the GDPR applies “to the processing of personal data in the context of the activities of an institution of a controller or a processor in the Union, regardless of whether the processing takes place in the Union or not.”
In examining the facts and applying Article 3 (1), the Court of Justice took into account the decisions of the Court of Justice of the European Union in the Google Spain, Weltimmo and Amazon cases. The court ruled that the defendants were not resident in the UK for the purposes of the GDPR and the judge found that the defendant had no employees or agents in the UK. While Forensic News had a readership in the UK, the judge felt that a handful of UK subscriptions to a platform that requests payment for services on a generic basis “are unlikely to be sufficient agreements”. Number and type to meet the language and spirit of Article 3 (1) and be “stable”. “
Article 3 (2) (a) – Offer of goods or services
According to Article 3 Paragraph 2 Letter a, the GDPR applies to the processing of personal data of data subjects who are located in the Union by a data controller or processor who is not based in the Union if the processing activities are carried out with the offer of Goods or services are related to such data subjects in the Union, regardless of whether a payment from the data subject is required. “
Mr Soriano argued that the defendants passed this test because the defendants’ publications were in English, their website requested donations in pounds sterling and euros, a “shop” of proprietary branded merchandising and shipping addresses Britain would be accepted. In deciding on this point, we referred to the guidelines of the European Data Protection Board on the territorial scope of the GDPR and concluded that there is no evidence that Forensic News is targeting its goods or services to anyone in the UK. To the extent that Forensic News was providing services to individuals in the UK, the Court decided that the offering of the services must be related to Forensic News’ “core activities”, ie journalism. The Court found that this is not the case.
Article 3 (2) (b) – Conduct monitoring
According to Article 3 (2) (b), the GDPR applies to the processing of personal data of data subjects who are located in the Union by a controller or processor who is not established in the Union if the processing activities involve monitoring their Data are related to behavior insofar as their behavior takes place within the Union. “
In light of the above, the Court concluded that Mr Soriano did not have a contentious case under the GDPR.
While unsuccessful in his GDPR lawsuit, Mr Soriano received permission to pursue proceedings outside the UK for the misuse of the request for private information (for the photos only) and the defamation lawsuit.