Kerry Underwood


leave a comment »

In September and October I am delivering my new course – Getting the Retainer Right – in 10 cities – details and booking form here

In Sabados v Facebook Ireland [2018] EWHC 2369 (12 June 2018)

the High Court granted a Norwich Pharmacal order requiring Facebook to disclose the identity of the person unknown who requested deletion of the deceased’s profile.

The claimant, Sabados, had been in a close personal relationship with the deceased and deletion resulted in the irrecoverable loss of posts and messages including photos of the two together.

Some of the information on the deceased’s profile, such as messages the claimant sent to the deceased, contained her personal data and procuring deletion would amount to a breach of the Data Protection Act 1998.

Facebook did not acknowledge service and were not represented at the hearing.

The order was required because Facebook declined to reveal who made the deletion request.

The claimant satisfied the three conditions for a Norwich Pharmacal order:

  • there was a good arguable case that the deletion of the deceased’s profile amounted to breach of the Data Protection Act 1998 and misuse of private information.

It was also arguable that the requestor committed a breach of confidence/misuse of private information if they had access to the deceased’s profile prior to deletion.

  • The claimant did not have sufficient information to formulate her claims without the order.
  • Facebook was unequivocally mixed up in the unknown person’s wrongdoing

Although the court was concerned by the proposition that it could take jurisdiction on the basis of distress suffered in England in respect of actions which took place in the Republic of Ireland, and possibly Bosnia, it held that there was an arguable case that the English court had jurisdiction under the Recast Brussels Regulation (RBR) to make the order on the basis that the alleged damage was suffered in England for the purposes of Article 7(2) of the Recast Brussels Regulation.

This case was heard under the Data Protection Act 1998 but is a useful reminder of the care required when handling requests for deletion of personal data both to ensure the requestor has appropriate authority and in relation to any third party data involved.

Written by kerryunderwood

September 27, 2018 at 8:06 am

Posted in Uncategorized

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

%d bloggers like this: