03/02/2020 CG v Facebook Ireland Ltd & Anor [2016] NICA 54 (21 December 2016) services concerned. The concept of establishment extended to any real and effective activity, even a minimal one, exercised through stable arrangements. [84] The court noted that Weltimmo clearly pursued a real and effective activity in Hungary through its website. It had a representative in Hungary who had sought to negotiate a settlement of unpaid debts with the advertisers. It had a bank account in Hungary. It had an address for the management of its everyday business affairs in Hungary. The court concluded that that was sufficient to constitute an establishment. If those matters were proved Weltimmo was established in Hungary as that was sufficient to prove that the processing of personal data was carried out in the context of the activities of the establishment. [85] We have already discussed at paragraph [73] the circumstances in which the data protection issue emerged before the learned trial judge. It is, however, not clear how the issue developed before him. Although it appears that Google Spain may have been cited to him there is no discussion of it in that part of the judgment dealing with the establishment issue. He could not, of course, have considered Weltimmo since neither the Advocate General’'s opinion nor the court’'s decision were published prior to the delivery of judgment. We simply do not know what legal principles the learned trial judge applied in coming to his determination that Facebook was not established in the United Kingdom. [86] In seeking to support the judge’'s conclusion Mr White relied first upon the line of authority set out in Murray v Royal County Down Golf Club [2005] NICA 52 that where the only matter for decision is whether the judge has come to a right conclusion on the facts the court should not interfere unless he has not taken all the circumstances into consideration or has misapprehended the evidence or drawn an inference which there is no evidence to support. The difficulty with that submission is that the case law to which we have referred sets out how the court should determine whether the data controller is established in this jurisdiction and whether the data are processed in the context of that establishment. The judge made no reference to that case law. The determination of this issue is not a pure question of fact and in the absence of any consideration of the authorities by the judge we are obliged to consider them on appeal. [87] Secondly, the first appellant submitted that the mere fact that the Facebook service was accessible in the UK did not mean that it was established here. We agree. Recital 19 of the eCommerce Directive reinforces that point. Thirdly, Mr White relied upon Richardson v Facebook and Google (UK) Ltd[2015] EWHC 3154 (QB). In that case Warby J upheld the Master’'s Order striking out a libel claim against Facebook (UK) Limited based on publications on the Facebook Service on the ground, inter alia, that Facebook (UK) Limited was not the entity responsible for hosting or controlling the Facebook Service. That is not, of course, the issue in this case and Warby J expressly left open at paragraph [59] the conclusion that the data processing activities of Facebook undertaken in England and Wales were carried out in the context of advertising and other activities by Facebook (UK) Ltd so that they were subject to English data protection law. This case is, therefore, of no assistance to the first appellant. [88] The principal argument advanced by Facebook was that it was established in a member state of the EU, Ireland, and was regulated in terms of data protection by the domestic law of that member state which implemented the Data Protection Directive. It was not regulated by the domestic law of other member states from which its service was accessible. The Data Protection Directive emphasises the objective of an internal market and free cross-border flow of data between member states. The nationality or place of residence of the data subject, the place where the data processing took place and the place of which the service was accessible were not relevant to the location of the establishment. Mr White accepted, however, that the data controller may be established in a number of member states and be subject to the data protection laws within those member states although he noted the risk of inconsistent approaches in different member states. [89] On behalf of Facebook it was submitted that the decision in Google Spain was motivated by the particular circumstances of that case. The court was asked to hold that EU residents did not benefit from data protection rights when they dealt with the provider of Internet services located in the United States. Accordingly it was submitted that the court adopted an expansive approach to the www.bailii.org/nie/cases/NICA/2016/54.html 19/21