05/02/2020 Galloway v Frazer & Ors [2016] NIQB 7 (27 January 2016) "The pursuer sues for compensation for contravention by the defendant of one or more of the requirements of the Data Protection Act 1998. To plead a relevant case he must identify a requirement of the Act and aver the manner or respect in which he says that it was contravened by the data process he complained of. In our opinion the pursuer has clearly failed to do that …" However there is no requirement under the Rules to serve a draft statement of claim although the Supreme Court Practice recommends it as good practice. The issue at this stage and before this court is whether leave should be given to serve out of the jurisdiction not whether the pleadings comply with the rules of court. That may be a matter for another day. But in this case the plaintiff did not see fit to include a claim for breach of the 1998 Act in the original writ. [76] There was a considerable debate as to whether Google in operating YouTube acted as a data controller or a data processor. A data controller is someone who "determines" the purposes for which and the manner in which personal data, are, or are to be, processed. On the other hand a data processor is a person "who processes the data on behalf of the data controller". [77] Section 1(1) of the Act defines processing as follows: "Processing, in relation to information of data, means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information of data, including – (a) organisation, adaptation or alteration of the information or data; (b) retrieval, consultation or use of the information or data; (c) disclosure of the Information or Data by transmission, dissemination or otherwise making available; or (d) alignment, combination, blocking, erasure or destruction of the information or data." [78] There is force in the submissions on behalf of the plaintiff that YouTube's conditions of use suggest that it acts as a controller rather than a processor. However the court does not have enough information it can rely on in order to come to a definite conclusion on what is bound to be a fact specific investigation and which will be heavily dependent on the evidence which is adduced. That will have to await the full trial. I am of the view that issues such as whether Google when in its guise as YouTube is a data controller and, if so, whether there is a defence when, for example, there is publication of sensitive personal data in cases such as the present one, are controversial matters in a developing area of law which are going to be heavily dependent on the facts as found by the trial judge. I agree with Tugendhat's comments at paragraph [102] in Judith Vidal-Hall and Others v Google Inc [2014] EWHC 13 (QB) where he said: "This is controversial question of law in a developing area, and it is desirable that the facts should be found. It would therefore be the better course in the present case that I should not decide the question on this application." [79] Section 4(4) imposes duty on a data controller (subject to specified exemptions) to comply with the "Data Protection Principles" in relation to all personal data with respect to which he is a data controller. The data protection principles are set out in Part I of Schedule 1 to the Act. Included within these principles is the principle at paragraph 4 of Schedule 1 Part 1 which states: "Personal data shall be accurate and, where necessary, kept up-to-date." [80] Sensitive personal data means personal data consisting of information as to "his personal opinions", "the commission or alleged commission by him of any offence": see Section 2(b) and (g) of the Data Protection Act. file:///Users/nerissa/Downloads/Columbia CSV/Galloway v Frazer & Ors [2016] NIQB 7 (27 January 2016).htm 21/26