03/02/2020 CG v Facebook Ireland Ltd & Anor [2016] NICA 54 (21 December 2016) public domain can, through the passage of time, recede into the past and become part of a person''s private life. [31] In considering the reasonable expectation of privacy the context was important. The PPANI provided a framework in which information concerning convicted sex offenders was to be disclosed. The disclosures on Predator 2 were contrary to those arrangements. That is relevant to the reasonable expectation question. Secondly, this information was published in combination with other information with the express intention of inciting others to intrude into the respondent’'s personal space and otherwise interfere with his right to family life. [32] Mr Tomlinson noted that the pleadings in the XY litigation expressly referenced Predators 2. Accordingly Facebook plainly had actual knowledge that McCloskey was operating Predators 2 for the purpose of seriously interfering with the family life of sex offenders. The judge was correct to infer that Facebook was aware of the nature of his unlawful activity and that one of the individuals being targeted was the respondent. The judge did not impose any general obligation to monitor or actively seek out facts and circumstances indicating illegal activity. He drew the correct inference as to Facebook’'s actual knowledge. It was accepted that the correspondence from the respondent''s solicitors did not specifically identify the unlawful activity. It is likely that some investigation would have been carried out and as a result the relevant knowledge would have been acquired. [33] In its original defence Facebook admitted that it was a data controller for the purposes of the Data Protection Act 1998 (the 1998 Act). In the course of the trial it amended its defence to contend that the 1998 Act did not apply to the first appellant. The basis for this was that section 5 of the 1998 Act applied to a data controller only if the data controller was established in the United Kingdom and the data was processed in the context of that establishment. Section 5(3)(c) of the 1998 Act stated that a person was established in the United Kingdom if it maintained in the United Kingdom an office, branch or agency through which it carried on any activity or maintained a regular practice. [34] It was common case that Facebook was a data controller established in the Republic of Ireland and that the information on the Predators 2 page was personal data and sensitive personal data of which the respondent was the data subject. The evidence indicated that Facebook UK Ltd provided marketing support services to Facebook and processed certain personal data on its behalf in the United Kingdom. There was no applicable discovery made by Facebook in relation to this issue and no request by the respondent for discovery of particular documents. [35] The learned trial judge found that there was a relatively high level of possibility that Facebook maintained an office, branch or agency through which it carried on an activity in the United Kingdom by virtue of its relationship with Facebook UK Ltd but on balance was not persuaded that the respondent had established that to the requisite standard. By way of cross appeal Mr Tomlinson submitted that, in particular, the decision of the CJEU in Google Spain v AEPD [2014] QB 1022 supported the view that section 5 of the 1998 Act should be given a broad interpretation and that the judge had erred in his approach. [36] Mr White submitted that the issue was one of fact for the judge. In Google Spain the court expressly stated on a number of occasions that it was necessary to adopt an expansive approach to the applicable law test because of the risk that the data subject would be left unprotected compromising the principle of effectiveness. This was not such a case because the first appellant was established in the Republic of Ireland. The approach of the learned trial judge was consistent with the decision of the ECJ in Weltimmo v Nemeti (C-230/14) EU which stated that the concept of establishment depended upon real and effective activity exercised through stable arrangements. It was accepted that an entity could be established in more than one member state and if so it had to comply with the relevant law in each such state. Consideration [37] Before turning to the areas in dispute between the parties it is helpful to record the areas of agreement. There was no dispute about the finding of the learned trial judge that McCloskey had harassed the respondent. That was based on his conclusion that McCloskey intended to torment the www.bailii.org/nie/cases/NICA/2016/54.html 8/21