High Court of Ireland Decisions

THE HIGH COURT

 

 

 

 

 

[2023] IEHC 573

Record No. 2021/4177P

 

 

BETWEEN

 

 

DIGITAL RIGHTS IRELAND COMPANY LIMITED BY GUARANTEE

 

PLAINTIFF

 

 

AND

 

DISCORD INC.

 

RESPONDENT

 

Judgment of  Mr. Justice Brian O’Moore  delivered the 20th day of October 2023

 

 

1.             “Revenge Porn” is the commonly used phrase to describe the reprehensible practice of posting online images of sexual activity without the consent of one of the participants.  The plaintiff (“DRI”) describes itself as “an Irish rights body devoted to defending civil, human and legal rights in the digital age…”.  DRI has been mandated by six women who, it is claimed, have been affected by revenge porn postings on a specific web page.  I am told that this web page displays “intimate images of thousands of women … in breach of those women’s rights …”.

2.             An account hosted by Discord Inc. (the original defendant to these proceedings) displayed these images on a specific web page, the location of which is described in the grounding affidavit to this application.

3.             With the approval and authority of six of the women affected, DRI wishes to launch an action in a representative capacity pursuant to Art. 80(1) of the General Data Protection Regulation and s. 117(7) of the Data Protection Act, 2018.  However, DRI cannot launch any such proceedings until the identity of the persons who have posted the images on the Discord website is disclosed. 

4.             The current application, therefore, is for Norwich Pharmacal type relief which would enable the intended representative action to be commenced. 

5.             It is important to stress that no complaint is made by DRI, or the six women whom it represents, about the activities of Discord. 

6.             While the current application is somewhat complicated, by reason of the fact that the original defendant (Discord Inc.) has transferred certain material (including the data concerned) to Discord Netherlands BV, the approach taken by both of the Discord entities means that the application for a Norwich Pharmacal type order can be dealt with relatively quickly.

7.             As far as both Discord Inc. and Discord Netherlands is concerned, there is no opposition to the court making the following orders: -

(a)        that Discord Netherlands is substituted as the sole defendant to these proceedings; and

(b)       that Discord Netherlands is ordered to disclose certain information to DRI, within 28 days of the making of this order. 

8.             Even if there was no consent to an order of this sort, I feel that this form of order is appropriate.  Firstly, I am told that Discord Netherlands is the controller of the relevant data and therefore it is the appropriate person who should be subject to the Norwich Pharmacal type application.  Secondly, applying the principles set out in Norwich Pharmacal itself, Megaleasing UK Limited v Barrett (No. 2) [1993] ILRM 497 and EMI Records Ireland Limited v Eircom Limited [2005] 4 IR 148, disclosure of information by Discord which may identify the persons posting the impugned images is necessary in order to allow DRI (and the women it represents) to bring proceedings designed to vindicate their rights under the relevant legislation.  The information which the parties agree I should order to be disclosed is limited to information which enables the intended representative action to be brought.

9.             With regard to the role of DRI, I am satisfied that on the evidence before me that it qualifies as a “not for profit body, organisation or association…” within the meaning of s. 117(7) of the Data Protection Act, 2018.  Such bodies are authorised to bring a data protection action as a representative plaintiff.  Section 117(7) of the 2018 Act sets down the following conditions for a body so to qualify.  These are that: -

“(a)     they provide that service is on a not for profit basis;

(b)        it has been properly constituted in accordance to the laws of the State …;

(c)        it’s objectives are specified in its constitutional documents and are in the public interest; and

(d)        it is active with regard to the protection of data subject rights and freedoms, including the protection of their personal data.”

Of course, my finding to this effect is not a final or binding one, and is made solely for the purpose of the current application.

10.         Because the order now sought is one against a Dutch company, it was thought appropriate that there would be written submissions to identify the jurisdiction to make the order.  These submissions, presented by Frank Crean BL and settled by Ronan Lupton SC, have been of great assistance.

11.          Article 79 of the GDPR (and implemented by s. 117(1) of the 2018 Act) guarantees that: -

“Each data subject shall have the right to an effective judicial remedy … as a result of the processing of his or her personal data in non-compliance with the GDPR.”

12.         Article 79(2) of the GDPR provides that proceedings against a Controller or a Processor may be brought either before the courts of the Member State where the Controller or Processor has an establishment or before the courts of the Member State where the data subject has his or her habitual residence.  The six women who have mandated the bringing of the intended action and of the current application are described as “six Irish data subjects”.  Discord is the Controller or Processor of the relevant data, either historically (in the case of Discord Inc.) or currently (in the case of Discord Netherlands).  The intended action is one grounded in tort and seeking damages against the persons who posted the images on the internet.  It follows on that analysis that the current application constitutes proceedings which can be brought in the Irish courts pursuant to Art. 79(2) of the GDPR.  In any event, whatever concerns I had about jurisdictional issues are addressed by the fact that the solicitors acting for the two Discord entities have agreed that the Norwich Pharmacal orders should be made.   This is notwithstanding the fact that the solicitors for Discord Inc. initially were instructed to enter a conditional appearance to the current proceedings, and that there has been extensive correspondence disputing the jurisdiction of the courts of Ireland to make the orders initially sought by DRI.

13.         I will therefore make an order substituting Discord Netherlands for Discord Inc. as the sole defendant to these proceedings, and requiring Discord Netherlands to disclose the agreed information to DRI within 28 days of the perfection of this order.  The precise form of the order is to be sent, in agreed form, to my Registrar and the parties are at liberty to apply with regard to any outstanding matters.