03/02/2020 CG v Facebook Ireland Ltd & Anor [2016] NICA 54 (21 December 2016) (a) the data controller is established in the United Kingdom and the data are processed in the context of that establishment… (3) For the purposes of subsection (1)… each of the following is to be treated as established in the United Kingdom-… (d) any person who … maintains in the United Kingdom(i) an office, branch or agency through which he carries on any activity, or (ii) a regular practice; and the reference to establishment in any other EEA State has a corresponding meaning.”" The case was opened and began before Stephens J on the basis that the Act applied to Facebook and at paragraph 5 of its defence it admitted that it was the data controller with respect to the data of users based outside of the United States of America and Canada of the social network for the purposes of the 1998 Act. During the hearing Facebook was given leave to amend its defence to plead that the Act did not apply to it in respect of that data for the reasons set out below. [75] It was agreed that the information on Predators 2 was personal data and sensitive personal data of which the respondent was the data subject. Facebook was the data controller in respect of that data. As appears from paragraph 3 above Facebook is a private limited company incorporated in the Republic of Ireland. Facebook UK Limited is a private limited company incorporated in the UK which provides marketing support services to Facebook and obtains all of its income from providing those services. Its function includes the generation of advertising revenues in the UK. It has offices in the UK but does not operate, host or control the Facebook service. A data processing agreement is in place between Facebook and Facebook UK Limited under which Facebook UK Limited as “"data processor”" processes certain personal data on behalf of Facebook in order to generate advertising revenue in the United Kingdom. The respondent submitted that Facebook was established in the United Kingdom by virtue of its relationship with Facebook UK Ltd. [76] The learned trial judge concluded that on balance he was not persuaded that the respondent had established that Facebook, by virtue of its relationship with Facebook UK Limited, maintained an office, branch or agency through which it carried on any activity in the United Kingdom. He noted that in light of the way that the issue arose in the course of the proceedings no discovery on this issue had been sought or provided and accepted that a different conclusion could be reached on different facts in another case. [77] Section 5 of the 1998 Act gave effect to Article 4 of the Data Protection Directive 95/46/EC dealing with the national law applicable: ""1. Each Member State shall apply the national provisions it adopts pursuant to this Directive to the processing of personal data where: (a) the processing is carried out in the context of the activities of an establishment of the controller on the territory of the Member State; when the same controller is established on the territory of several Member States, he must take the necessary measures to ensure that each of these establishments complies with the obligations laid down by the national law applicable;"" [78] Article 4(1)(a) of this provision was the subject of extensive consideration by the ECJ in Google Spain v AEPD and Gonzalez Case C-131/12 [2014] QB 1022. The background was that Mr Gonzalez complained to AEPD (the Spanish Data Protection Agency) that a Google search against his name in 2010 contained a link to two newspaper reports in 1998 where his name appeared in respect of a real estate auction arising from attachment proceedings for the recovery of Social Security debts. www.bailii.org/nie/cases/NICA/2016/54.html 17/21