Court of appeal case addresses territorial application of GDPR

Published 31 January 2022

The Court of Appeal has delivered its first decision on the territorial scoping provisions of the GDPR in the case of, Soriano v Forensic News LLC & Others¹. The case derived from a libel action by a British businessman against six defendants, all domiciled in the USA, the first five of which were employed by the California-based news site, Forensic News, on which allegedly defamatory material regarding the claimant had been published.

The claimant alleged that the first five defendants had misused his private information in respect of eight publications and social media posts, and that they had breached data protection obligations owed to him. The basis of this claim, and a point on which the claimant was cross-appealing the lower court’s decision, was that he had an arguable case (i.e. one capable of resisting summary judgment) as to the extra-territorial application of English data protection law under Article 3 GDPR.

For the sake of clarity, Article 3 of the UK GDPR, is set out as below. We note that there is an equivalent provision under Article 3 of the EU GDPR.

1. This Regulation applies to the processing of personal data in the context of the activities of an establishment of a controller or a processor in the United Kingdom, regardless of whether the processing takes place in the United Kingdom or not.
   
   
2. This Regulation applies to the relevant processing of personal data of data subjects who are in the United Kingdom by a controller or processor not established in the United Kingdom where the processing activities are related to:
   1. the offering of goods or services, irrespective of whether a payment of the data subject is required, to such data subjects in the United Kingdom; or
   2. the monitoring of their behaviour as far as their behaviour takes place within the United Kingdom.
      
      
3. This Regulation applies to the processing of personal data by a controller not established in the United Kingdom, but in a place where domestic law applies by virtue of public international law.

In his judgment on this appeal, Warby J needed to decide whether there was an arguable case that defendants 1-5 were ‘established in the UK or EU.’ This meant establishing whether there had been any real and effective activity – even minimal activity – exercised through stable arrangements. On this point, Warby J held that ‘Patreon’ subscriptions to the defendants’ news site were solicited from the UK and arguably constituted a stable arrangement.

Secondly, the Court of Appeal had to decide whether, in relation to Article 3(2), there was an arguable case that the defendants’ processing of personal data for the purpose of journalism was related to the offering of goods or services within the UK or EU. Again, Warby J held that there was an arguable case that the Forensic News website offered a service to readers in the UK or EU that was related to their processing of personal data.

Lastly, the court decided whether there was an arguable case that the processing of personal data was related to monitoring of behaviour within the UK or EU. Once more, Warby J held that yes, an arguable case did exist to support this proposition.

From a data protection and data risk perspective, this case has proven to be significant in so far as it addresses the potential extra-territorial application of the GDPR. On the basis of this judgment, those based outside the UK or EU, but offering paid subscriber or free services via a website, including journalism, may find themselves caught by GDPR data protection obligations.

¹[2021] EWCA Civ 1952