Facebook Ordered to Reveal Identity of Imposter

The High Court has ordered Facebook to reveal the identity of an anonymous person who was behind a request to delete a deceased man’s profile.

In 2016, Mirza Krupalija died suddenly of a heart attack. Six months later, his partner Azra Sabados lost him “a second time” when Facebook deleted his profile which contained messages between the couple, photographs of times they shared and recordings of songs he played with his jazz band, Kaiten, whose page was also deleted.

Ms Sabados was not consulted by Facebook over the decision nor were Mr Krupalija’s family, which means whoever made the request did so on the pretence they were Mr Krupalija’s next of kin. In response, Ms Sabados launched an online petition and has been in talks with Facebook for the past year. After months of resistance, she decided to litigate to seek redress from whoever deleted the profile and has brought Facebook before a judge seeking a Norwich Pharmacal Order (NPO) which compels Facebook to disclose this information.

What is a Norwich Pharmacal Order?

In Norwich Pharmacal v Commissioners of Customs and Excise [1974] UKHL 6, the House of Lords held that a court has equitable jurisdiction to order one party to disclose the identity of another party to a claimant. An NPO is typically obtained where a party knows that wrongdoing has taken place against it but does not know the identity of the wrongdoer, yet can identify a third party who has this information.

In deciding to make the NPO, the High Court, in Sabados v Facebook Ireland Ltd (2018 unreported), was satisfied that Ms Sabados had at least a good arguable case that a wrong was carried out by an ultimate wrongdoer. Essentially, this is a check that Ms Sabados has a cause of action in law.

The court was satisfied that the profile’s deletion may constitute a misuse of Ms Sabados’ personal information and a breach of the Data Protection Act 1998. Therefore, once Facebook have disclosed the person’s identity, Ms Sabados has the option of continuing her claim against that person in the above causes of action.

The prerequisites to obtaining an NPO are:

• There are no other relevant CPR provisions
• The respondent is likely to have relevant documents or information
• There is a good arguable case that there has been a wrongdoing
• The “mere witness” rule is not infringed
• The respondent is involved in the wrongdoing
• The order is necessary in the interests of justice, and is not sought for an improper purpose

Facebook’s Liability

The Data Protection Act 1998 (DPA) aims to prevent the processing of personal data unless it is required by law; or for the performance of a contract with the data subject; or to protect the data subject’s vital interests; or if the data subject consents.

As processing includes the destruction of data and none of the above grounds applies, a case can be made to say that Ms Sabados’ personal information was unlawfully processed when the profile was deleted. The information is more likely sensitive personal data as it may betray her racial or ethnic origin, political opinions, religious beliefs, physical and mental condition or sexual life; although, this would depend on exactly what the profile contained.

If it is sensitive, Facebook will be held to a higher standard, requiring not just consent but Ms Sabados’ explicit consent to delete the profile. Clearly, no such consent was given.

Moreover, the DPA requires organisations to take appropriate measures to prevent unlawful processing. Facebook “must ensure a level of security appropriate to the harm that might result from such unauthorised or unlawful processing or accidental loss or destruction”.

It is Facebook policy to memorialise an account once they are notified of a person’s death. It seems this never happened. It is also policy to ensure that a deceased person’s profile can only be deleted on the request of their next of kin. This person must provide documentation to prove they are “an immediate family member or executor of the account holder.” This can be done by sending to Facebook a copy of the death certificate or evidence that they have the authority to request its removal and proof of the user’s passing.

It appears that in this instance, Facebook may have failed to follow their own procedures and did not properly verify the wrongdoer as an immediate family member or check that they had the authority to delete Mr Krupalija and Ms Sabados’ personal information. As a result, Ms Sabados may also have a cause of action against Facebook as a data subject.

Conclusion

Though the law is not an obstacle, access to it may be. The costs of pursuing a claim against an internet behemoth like Facebook in a jurisdiction where the loser pays for the other side could prevent any such suit and dissuade potential claimants.

A final point to note. Terry Tennens, Chief Executive of the National Society of Allied and Independent Funeral Directors said in 2016:

“We would encourage people to leave clear instructions about what should happen to their emails, social networking sites and other online accounts. It may be sensible to highlight any login details or passwords in a separate document alongside their will.”

Originally published at ipharbour.com on July 19, 2018.