Board of Management of Salesian Secondary College (Limerick) v Facebook Ireland Ltd

• Jurisdiction: Ireland
• Judge: Mr. Justice Garrett Simons
• Judgment Date: 19 May 2021
• Neutral Citation: [2021] IEHC 287
• Docket Number: 2020 No. 1419 P
• Court: High Court
• Date: 19 May 2021

Between

Board of Management of Salesian Secondary College (Limerick)

Plaintiff

and

Facebook Ireland Limited

Defendant

[2021] IEHC 287

2020 No. 1419 P

THE HIGH COURT

Disclosure – Privacy – Data protection – Plaintiff seeking disclosure – Whether the user of a social media platform, who has chosen to be anonymous, is entitled to an expectation that that choice will be respected absent some countervailing public interest objective in disclosure

Facts: The plaintiff, the board of management of Salesian Secondary College (Limerick) (the school authorities), apprehended that an inactive Instagram user account had been operated by individuals who were either students or staff members of the school. The objective of the proceedings was to compel Instagram to identify those individuals for the stated purpose of dealing with them by way of a disciplinary or pastoral response. The disclosure order was not sought for the purposes of instituting legal proceedings against the individuals whose identity was to be unmasked. There was no ongoing mischief alleged. The offending user account had been rendered inactive within a matter of days of its first being created. The content had been removed and the school authorities had the password to the user account. The application for the disclosure order was first moved in court more than one year after the user account had been rendered inactive. There was no evidence before the High Court that either An Garda Síochána or the Child and Family Agency were sufficiently concerned by the complaints made to them by the school authorities to seek information from the defendant, Facebook, themselves.

Held by Simons J that the school authorities’ application presented significant legal issues in respect of privacy, data protection and freedom of expression. He proposed making a reference to the Court of Justice of the European Union for a preliminary ruling pursuant to Article 267 of the Treaty on the Functioning of the European Union. The issues to be addressed in the reference were as follows: (1) Do the rights conferred under Article 7, Article 8 and Article 11 of the Charter of Fundamental Rights of the European Union imply a right, in principle, to post material anonymously on the internet (subject always to any countervailing objective of public interest)? If so, is this right qualified in the case of the students and staff of a secondary school? (2) What is the threshold to be met under the General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) and/or the Charter before the provider of a social media platform can be compelled to disclose, to a third party, information which would identify an otherwise anonymous account user? Is it necessary for the third party seeking disclosure to establish a strong prima facie case of tortious wrongdoing and an intention to pursue legal proceedings? Alternatively, does the board of management of a secondary school have a sufficient interest in disciplining its students and staff for their online activities to entitle it to disclosure, even in the absence of an intention to pursue legal proceedings? If so, is it necessary to establish that the online activities are disruptive to the school environment? (3) Is there any necessity for a national court to attempt to put the affected party on notice of an application which seeks to identify the operators of an otherwise anonymous user account? Should, for example, the national court direct that the social media platform notify the party and inform them that they have an opportunity to make submissions anonymously to the court?

Simons J held that he would hear the parties as to the precise form of reference. He requested the applicant’s solicitors to furnish a copy of this judgment to the Office of the Attorney General and to the Commission for Data Protection. He held that those parties had liberty to apply to be heard on the form of the reference.

Article 267 Reference to Court of Justice for a preliminary ruling.

JUDGMENT of Mr. Justice Garrett Simons delivered on 19 May 2021

INTRODUCTION

1 The objective of these proceedings is to compel the social media platform, Instagram, to identify the individuals behind one of its user accounts. The proceedings are taken by the board of management of a secondary school (“ the school authorities”). The school authorities apprehend that the now inactive user account had been operated by individuals who are either students or staff members of the school. The school authorities seek to identify these individuals for the stated purpose of “dealing with” them by way of what the school authorities describe as a “disciplinary or pastoral response”.

2 The disclosure application presents significant legal issues in respect of privacy, data protection and freedom of expression. For the reasons set out in this judgment, I have concluded that it is necessary to make a reference to the Court of Justice of the European Union for a preliminary ruling on these issues. This reference will be made pursuant to Article 267 of the Treaty on the Functioning of the European Union (“ TFEU”).

PROCEDURAL HISTORY

3 These proceedings relate to a user account which had been published on the social media platform, Instagram. This platform is, seemingly, provided by the defendant, Facebook Ireland Ltd.

4 The user account had only been active for a short period of time, between 14 October and 24 October 2019. The user account had been employed to publish a series of posts, consisting of photographs or other images with supposedly humorous text superimposed. It should be explained that the photographs and images themselves do not feature any one associated with the school. Rather, they appear to be stock images sourced elsewhere on the internet. It is the text which links the photographs and images to individuals and events at the school.

5 In total, approximately fifty two posts were published via the user account. Much of the content is coarse and vulgar. In some instances, the content of the posts ridicules members of the school's staff by reference to their personal appearance, weight and sexuality. In other instances, the posts reference aspects of school life, such as, for example, the high cost of food on campus and a change to the structure of the timetable.

6 It is said that a named student has been ridiculed or mocked, but no detail whatsoever has been provided on affidavit as to what is being referred to here.

7 The user account featured, without permission, the secondary school's address, crest and name, and referred to its official website. Given the coarse and vulgar content of the posts, however, it is inconceivable that anyone viewing the user account would mistake it for an “official” school account.

8 The school authorities became aware of the existence of the user account within a matter of days of its first being activated. Thereafter, a solicitor representing the school authorities posted a series of messages to the user account, calling on those operating it to delete the user account immediately. In response, the operators of the user account removed the published content the next day.

9 On the day following that, the school authorities obtained access to the password to the user account. The password was seemingly obtained from a student, who, in turn, had been provided with it anonymously by an individual operating the user account. Armed with the password, the school authorities were in a position to access the messaging function. This revealed that twenty-one students from the school had been in communication with those operating the user account. The school authorities are especially concerned about the content of two messages which had a sexual element. It is accepted on affidavit, however, that these messages may have been intended to be sarcastic. The school authorities reported the matter to An Garda Síochána and the Child and Family Agency. There is no evidence before the court as to what steps, if any, these authorities considered necessary.

10 The school authorities have since removed the school's crest and details from the user account.

11 The school authorities sought to contact the company providing the social media platform and requested information with a view to identifying the individuals who had operated the user account. Facebook Ireland Ltd.'s position is set out as follows in a letter dated 23 December 2019 to the solicitors acting for the board of management.

“We write on behalf of our client Facebook Ireland in response to your letter dated 11 December 2019, which requests that Facebook Ireland provide the information related to the Instagram account Pallaskenrymemes (the ‘Account’) requested in your letters dated 8 November 2019 and 12 November 2019 on or before Friday, 20 December 2019.

Our client cannot disclose user information to a private third party without a court order or request from law enforcement. Any court order or law enforcement request requiring disclosure of account information must be addressed to and served upon Facebook Ireland, identify the Instagram account at issue by specific uniform resource locator (‘URL’).

It is a matter for the Court to determine whether such Norwich Pharmacal relief is appropriate. We are willing to review your client's application for Norwich Pharmacal relief to ensure that any court order is properly formulated and that Facebook Ireland may comply therewith.

Please note that we are not authorised to accept service on behalf of Facebook Ireland. As a courtesy, you may continue to copy us on any further correspondence related to this matter.

Facebook Ireland expressly reserves all of its rights.”

12 The school authorities instituted these...