High Court refers questions to the European Court of Justice in “striking” Norwich Pharmacal application

Introduction

This case was withdrawn by the Plaintiff School on 14 June 2021. The reasons for withdrawal are unknown. Facebook agreed to pay its own legal costs and the Plaintiff’s proceedings and motion seeking a Norwich Pharmacal Order were struck out. In the circumstances the reference to the CJEU will now not be made.

In a recent High Court decision of Mr. Justice Garrett Simons delivered on 19 May 2021 in a matter of Board Of Management Of Salesian Secondary College (Limerick) versus Facebook Ireland Limited[1], the Judge noted his intention to make a reference to the Court of Justice of the European Union (“CJEU”) pursuant to Article 267 of the Treaty on the Functioning of the European Union .

The Plaintiff school took proceedings after Facebook Ireland Limited (“Facebook”) advised it could not provide information identifying person(s) behind an Instagram account without a court order or a request from law enforcement. This is the standard response of social media platforms to such requests. The Instagram account is believed to have been operated by student(s) or staff member(s) of the school. The account was only active for a short period in October 2019 but many of its 50 or so posts were vulgar and ridiculed school staff and a student of the school. When the account was deactivated, the school was anonymously provided with the password for the account. When it accessed the account it saw that twenty-one students from the school had been in communication with the person(s) operating the account and two of the messages contained a sexual element and this was reported to An Garda Síochána (“Gardai”) and the Child and Family Agency, Tusla.

The school instituted proceedings on 21 February 2020, seeking an order directing Facebook to furnish it with the name, address, contact details, IP address and any other information capable of identifying the individual(s) behind the account. On the same day, the school also issued a motion seeking this relief on an interlocutory basis. Due to Covid19, the motion was not fixed for hearing until December 2020 at which time it was adjourned again to allow the Attorney General to be put on notice of the proceedings.

In considering whether to make the relevant order, known more commonly as a Norwich Pharmacal Order (the “Order”), the Judge noted that this particular application had a number of unusual features:

1. The Order in this case is not being sought for the purpose of instituting legal proceedings against the individuals behind the account but for the purpose of dealing with the relevant student(s) or staff member(s) in a disciplinary manner. There was some suggestion that the school might have an action in defamation but this was not the primary basis for its application and the court papers did not make out a prima facie case for defamation.
2. There is no “ongoing mischief” as the account is now inactive and the school has access to it.

3. The motion seeking interlocutory relief was first moved in court more than a year after the account was deactivated.
4. There is no evidence before the court that either the Gardai or Tusla were sufficiently concerned by the complaints that they sought the information from Facebook themselves.

Regarding point 1 above, to allow the Order to be made in this scenario would be a departure from the longstanding requirement and caselaw of the Irish courts, that an applicant must have an intention to pursue legal proceedings against the wrongdoer. The Court did note however that it is open in principle for the domestic jurisprudence to evolve and referred to the very recent High Court decision in Grace v. Hendrick[2] handed down on 10 May 2021. It was ordered in that case that the Congregation of Christian Brothers disclose the full names and addresses of its members from 1 August 1979 to 31 December 1984 who are still current members. In that case, the applicant (the victim of several incidents of sexual assault) sought an order requiring the disclosure of the names of members of the Congregation for the purposes of including them in the proceedings in circumstances where the Congregation refused to appoint a nominee in the case. No prima facie evidence of wrongdoing had been established against the individual members but the court relied on its inherent jurisdiction. It emphasised that membership of the Congregation was a matter of public record. By contrast, the disclosure order sought in the present proceedings engages the right to privacy, data protection and freedom of expression.

The Judge in the present case commented that “one of the striking aspects of applications of this type is that the individuals most directly affected, i.e. the very individuals whose identity the disclosure order is intended to reveal, are not on notice of the proceedings” and “the court must be satisfied that the disclosure is necessary for, and proportionate to, a legitimate aim”.

Given the Court’s concerns that the “disclosure application presents significant legal issues in respect of privacy, data protection and freedom of expression”, it made the decision to refer a number of questions to the CJEU for a preliminary ruling, namely:

1. Do the rights conferred under Article 7 [respect for private and family life], Article 8 [protection of personal data] and Article 11 [freedom of expression and information] of the Charter of Fundamental Rights of the European Union [“Charter”] imply a right, in principle, to post material anonymously on the internet (subject always to any countervailing objective of public interest)? If so, is this right qualified in the case of the students and staff of a secondary school?
2. What is the threshold to be met under the General Data Protection Regulation and/or the Charter before the provider of a social media platform can be compelled to disclose, to a third party, information which would identify an otherwise anonymous account user? Is it necessary for the third-party seeking disclosure to establish a strong prima facie case of tortious wrongdoing and an intention to pursue legal proceedings? Alternatively, does the board of management of a secondary school have a sufficient interest in disciplining its students and staff for their online activities to entitle it to disclosure, even in the absence of an intention to pursue legal proceedings? If so, is it necessary to establish that the online activities are disruptive to the school environment?
3. Is there any necessity for a national court to attempt to put the affected party on notice of an application which seeks to identify the operators of an otherwise anonymous user account? Should, for example, the national court direct that the social media platform notify the party and inform them that they have an opportunity to make submissions anonymously to the court?

The matter stands adjourned to 14 June 2021 for further directions and to allow the parties an opportunity to suggest the form of reference.

Conclusion

Applications for Norwich Pharmacal Orders are becoming commonplace particularly in relation to seeking information on users of social media accounts. In a society where schoolyard bullying has now moved online and schools are aware of this and often helpless if the targeting account is anonymous, the outcome of the reference to the CJEU, will be of great importance for educational institutions. It should also prove as a reminder and a deterrent to keyboard warriors behind faceless accounts that their anonymity is not guaranteed. Given the unusual circumstances of the case and application, it is unlikely to have any impact on the more common type of Norwich Pharmacal applications which are brought against social media platforms for the purpose of instituting proceedings against users who are posting material that is defamatory or otherwise unlawful.

The entire Judgement can be read here.