If private information material has been published on the Internet where can the wronged individual bring an action, and what law applies? These are the questions posed of the CJEU by the German Federal Court of Justice (the Bundesgerichtshof) and by the Tribunal de Grande Instance (Paris) in two cases – respectively eDate Advertising GmbH v. X, C-509/09 and Martinez v. Mirror Group Newspapers Limited, C-161/10 – which were heard and decided on together by the Grand Chamber of the Luxembourg Court on 25 October 2010.

The eDate Advertising case was brought in Germany against an Austrian domiciled company by a convicted murderer in respect of a cached website news report which named the murderer and his brother (who had been convicted along with him of the same crime), briefly described the crime of which they had been convicted, and noted that they had both lodged appeals against their convictions with the German Federal Constitutional Court (the Bundesverfassungsgericht). The matter at issue was whether or not the German courts had jurisdiction to hear and determine the brother’s application for an order restraining the Austrian company (in accord with German law) from giving his full name in its report.

The Martinez case was brought in France by a French actor and his father against a UK company, complaining that the web-publication by a British newspaper, the Sunday Mirror, of an article in English, with accompanying photographs, headlined “Kylie Minogue is back with Olivier Martinez” breached their privacy rights as guaranteed them under French law.

The issues of EU law for the CJEU to determine in each case involved the interpretation of provisions of the Brussels I Regulation (EC) 44/2001 on jurisdiction and the recognition and enforcement of judgments in civil and commercial matters and of Directive 2000/31/EC on the “free movement of information society services”.

Jurisdiction and the Brussels I Regulation

The primary rule for establishing jurisdiction under Article 2 of the Brussels I Regulation is that a defendant may be sued in the courts of the Member State where it is domiciled. The nationality of the parties is not a relevant factor, and in general the rules of the Brussels I Regulation will apply regardless of whether or not the plaintiff or pursuing party is domiciled or resident within a Contracting or Member State.

Article 5(3) of the Brussels I Regulation provides for a further “special” jurisdictional rule that “in matters relating to tort, delict or quasi-delict’” allows a person domiciled in one Contracting State to be sued in another Contracting State in “the courts for the place where the harmful event occurred”. In Bier v Mines de Potasse d’Alsace, C21/76, the Court of Justice held that the “place where the harmful event occurred” in Article 5(3) had a EU law meaning distinct from the rules applicable by national courts’ systems of international private law, and covered “both the place where the damage occurred and the place of the event giving rise to it. The result is that the defendant may be sued, at the option of the plaintiff, either in the courts of the place for the place where the damage occurred or in the courts for the place of the event which gives rise to and is the origin of that damage.”

In Shevill v Presse Alliance SA, C-68/93 the Court of Justice held that in the context of an action for defamation in respect of a newspaper article, the defamed individual should have the option of bringing an action against the publisher either in the courts of the Contracting State in which the publisher was established, recovering all damage suffered by the individual wheresoever caused, or before the courts of each Contracting State in which the libellous publication was distributed, recovering only such damage to his or her reputation as occurred within the national territorial jurisdiction of the particular court seised.

But internet publication knows no territorial limitations in that the content of web-published pieces may, in principle, be consulted by an unlimited number of internet users throughout the world. Accordingly the Grand Chamber in eDate and Martinez has formulated a new rule designed to allow a person who has suffered “an infringement of his personality rights by means of the internet” to bring an action in one forum in respect of all the damage caused to him or her. The CJEU holds that the court for the Member State where the alleged victim has their “centre of interests” constitutes the appropriate forum: this may be the State of the victim’s “habitual residence” or the State where she predominantly pursues her professional activities. What this means is that if you are defamed on the internet by someone or something with an EU domicile you have a choice of suing and recovering all the damages sustained by you either in the Member State where the publisher is domiciled or in the Member State courts where you have your “centre of interests”. You can also still sue under the Shevill rule in all any other Member States where the internet content can be accessed, but you can only recover damages in these other courts in respect of any damage sustained by you within their territory.

Directive 2000/31/EC and maintaining “the free movement of information society services”

On the question as to the substantive law to be applied in any such action against an internet publisher brought in the Member State where the victim has his “centre of interests”, the judgment of the CJEU is, alas, less clear. The Luxembourg court says that, subject only to the derogations permitted under its Article 3(4), Directive 2000/31/EC requires that anyone providing “electronic commerce services” should not be made subject to “stricter requirements” than those provided for in the Member State in which the service provider is established so as to ensure the free movement of “information society services” between the Member State.

The problem with this analysis is that the derogations permitted under Article 3(4) of the Directive are potentially very broad indeed. Article 3(4) of Directive 2000/31 allows Member States to restrict the freedom to provide information society services from another Member State by taking proportionate measures against a given “information society services” which prejudices or “presents a serious and grace risk of prejudice” to any of the following objectives:

(i) “public policy, in particular the prevention, investigation, detection and prosecution of criminal offences, including the protection of minors and the fight against any incitement to hatred on grounds of race, sex, religion or nationality, and violations of human dignity concerning individual persons

(ii) the protection of public health;

(iii) public security, including the safeguarding of national security and defence and

(iv) the protection of consumers including investors.”

This seems to be storing up trouble and simply inviting further litigation on whether, say “violations of human dignity concerning individual persons” encompasses the substantive (stricter) privacy rights accorded to individuals under German and French law than UK law, thereby allowing or requiring German or French courts to apply their strict privacy law in internet breach of privacy actions before them against UK based web-publishers.

The Rome II Regulation on choice of law for non-contractual civil wrongs

Given that the German court explicitly raised choice of law issues, it is surprising and marks something of a lost opportunity that the CJEU made no mention of the provisions of the Rome II Regulation (EC) 864/2007, which makes provision for determining among EU Member States (including the UK and Ireland but excluding Denmark) the applicable law in non-contractual civil wrongs. The provisions of the Rome II apply to events giving rise to damage which occurs on or after 11 January 2009. The Rome II Regulation is intended to create a flexible framework of conflict-of-law rules which are sensitive to particular fact situations but which are applied uniformly across the EU. It is envisaged that the provisions of the Rome II Regulation shall be interpreted consistently with the interpretation and application of both the Brussels I Regulation on jurisdiction in civil and commercial matters and the Rome I Regulation (EC) No 593/2008 on the applicable law of contracts.

The Rome II Regulation provides in Article 4(1) for a general rule that the applicable law in the case of a non-contractual civil wrong should be that of the place where the direct damage (rather than any indirect consequences) occasioned by the wrongful event could be said to have occurred (lex loci damni). This general rule is chosen over the alternative of founding the applicable law on the place where the wrongful event may be said to have been committed (lex loci delicti commissi), which was the more common rule in the civilian system of Continental Europe. For the EU, this rule was said to have engendered uncertainty in cross-border situations. By contrast, the choice of applying as the general rule the governing law of the country where the direct damage occurred, is said to strike a fair balance between the interests of the person claimed to be liable and the person sustaining the damage; and is also said (in Recital 16 of the Rome II Regulation) to reflect “the modern approach to civil liability and the development of systems of strict liability”. Accordingly, in cases of personal injury or damage to property, “the country in which the damage occurs” should be the country in which the injury was sustained or the property was damaged respectively.

Article 16 of the Rome II Regulation also envisages that, in some cases, the court seised may refuse to apply specific provisions of the otherwise applicable law on grounds of public policy (ordre public). The Regulation envisages, for example, the possible non-application of rules allowing non-compensatory exemplary or punitive damages of an excessive nature to be awarded.

Conclusion

The issue of establishing jurisdiction and choice of law in defamation/breach of privacy over the internet leave the CJEU on the horns of in a dilemma. On the one hand civilian systems of continental Europe such as those of France and German allow for a far greater protection of privacy rights than has been recognised heretofore in the common law systems of the British Isles, Malta and Cyprus. On the other hand, jury trials alleging libel or slander before the English courts have traditionally resulted in far higher awards of damages than would be regarded as normal or proper on the Continent. The stricter privacy protection afforded on Continental Europe may be thought to be alien to the traditions of the common law. The common law’s willingness to afford substantial damages where an individual has been defamed or slandered may be thought to be contrary to the public policy of continental systems

In granting jurisdiction to the courts of the Member State where the victim has his “centre of interests” to hear and award all heads of damage, while requiring those courts to apply their own privacy laws in a manner which is no “stricter” than those provided for in the Member State in which the service provider is established, the CJEU has attempted to resolve this dilemma. But its judgment somewhat papers over the cracks of a wide diversity of views from the various Member States as to what might be considered to be legitimate national public policy derogations from the principle of free movement of information over the internet across the Member States. There will doubtless be further litigation exploring all of these issues across the EU. Privacy rights as developed and applied in continental European systems such as France and Germany may yet find a way to take root and develop even within the potentially fertile virgin territory of England.