UK Court of Appeal considers territorial scope of GDPR

A recent UK Court of Appeal decision highlights ongoing uncertainty regarding the jurisdictional reach of the GDPR and invites intervention from the Information Commissioner’s Office.

The UK Court of Appeal has allowed a claim for contravention of the GDPR to be served on various US defendants, indicating that until the courts clarify the territorial scope of the GDPR there will be a low bar for the EU/UK nexus required to bring claims against non-EU/UK parties for breaches of the GDPR in the UK. Soriano v Forensic News LLC¹ is understood to be the first case anywhere in the EU and UK on the territorial scope of the GDPR under Article 3(2) and emphasises the broad geographic scope of both the EU GDPR and the UK GDPR.

The Court of Appeal decision related to permission to serve a claim outside the UK. The court did not have to reach a definitive conclusion on the territorial remit of the GDPR, but only whether the claimant’s position was sufficiently arguable.

Background

The claimant, Walter Soriano, commenced proceedings against US news outlet Forensic News and certain connected persons domiciled in the US, making various claims including under data protection law. The defendants had published a series of articles and social media posts making a number of “unflattering” allegations about Mr Soriano. In the UK, court permission is required to serve a claim outside of the jurisdiction (unless the defendants agree to be so served, which none of them did in this case). In deciding whether to grant permission, the Court of Appeal had to determine whether the claimant’s allegations that the GDPR applied had a real as opposed to a fanciful prospect of success.

The court considered each of the three grounds for data processing to be subject to the GDPR:

Article 3(1) of the GDPR provides that the GDPR applies to the processing of personal data “in the context of activities of an establishment of a controller or a processor” in the EU/UK (as applicable).

Article 3(2)(a) sets out that the processing of personal data of data subjects who are in the EU/UK by a controller or processor not established in the relevant territory is subject to the GDPR where the processing activities are related to “the offering of goods or services … to such data subjects”.

Article 3(2)(b) provides that the processing of personal data of data subjects who are in the EU/UK by a controller or processor not established in the relevant territory is subject to the GDPR where the processing activities are related to “the monitoring of their behaviour” as far as their behaviour takes place within the EU/UK.

Article 3(1) – Establishment in the EU/UK

While expressing doubts on the point, the court was prepared to find that it was arguable that the defendants had an “establishment” in the EU/UK because their subscription platform was potentially capable of satisfying the “stable arrangements” threshold for an “establishment” under the GDPR. The platform expressly solicited EU/UK subscriptions (available in sterling and euros) and had secured a number of UK/EU subscribers (albeit only 6). The court noted that the pre-GDPR case law on the meaning of “establishment” set a low bar and the court also specified that a critical consideration is whether the data controller envisages offering services to data subjects in the EU/UK.

Article 3(2)(a) – Offering goods or service to data subjects in the EU/UK

In relation to Article 3(2)(a), the court suggested that an ordinary reading of the words of Article 3(2)(a) indicated that it should only apply to processing of an individual's personal data where the processing activities are related to offering goods or services to that specific individual. Mr Soriano was not, the court said, one of the individuals to whom the services were offered. However, none of the parties had argued that Article 3(2)(a) should be interpreted in that way, so the court followed the approach of the parties in treating Article 3(2)(a) as also applying where the EU/UK data subjects whose data is processed are different to the EU/UK data subjects to whom goods or services are offered. This is an expansive interpretation which appears to have been used by Court of Appeal against its own reading of the provision because of consensus between the parties on this point.

Article 3(2)(b) – Monitoring behaviour of data subjects in the EU/UK

Finally, while the court doubted that mere collection of personal data relating to a data subject’s behaviour in the EU/UK would be enough to constitute “monitoring” for the purposes of Article 3(2)(b), additional manipulation of that information such as assembling, analysing, sorting and reconfiguring it into a published article was found to be more likely to fall within the definition of “monitoring” to bring the activity within scope.

Comment

The court’s analysis highlights continuing uncertainty in the geographic applicability of the GDPR. Broad interpretations are still very much on the table. Of particular note is the weight the court suggested must be given to an intention to offer goods/services to EU/UK individuals when considering whether a data controller has an ”establishment” in the EU/UK. Many businesses which offer goods/services to data subjects in the EU/UK from abroad may be deemed to have an ”establishment” in the EU/UK and may therefore need to comply with the GDPR not only in relation to the data of their EU/UK customers, but also any other individuals whose personal data is processed in relation to that establishment (such as staff).

However, it is important to note that this case relates to permission to serve a claim outside the UK. It was sufficient for the claimant to show that there was a more than fanciful prospect that the GDPR was broad enough to cover the allegedly infringing activity. The court therefore did not need to make any definitive findings on the territorial scope of the GDPR. The court also noted a need for “further and definitive consideration” of the issues and stated that the UK Information Commissioner should be invited to participate in the case to assist the court when it comes to make a final determination. Assuming that the case progresses rather than settles, the judgment on these issues following trial will be one to look out for.

Endnotes:

1) https://www.judiciary.uk/wp-content/uploads/2021/12/Soriano-v-Forensic-News-judgment.pdf