Go back to menu

English court rules on GDPR jurisdiction

Talking Tech - Case Note: Ramona Ang v Reliantco Investments Limited [2019] EWHC 879 (Comm)

25 April 2019

The English Court has now confirmed that the jurisdiction conferred on the court of a GDPR claimant's habitual residence takes priority over the requirements of the Jurisdiction and Judgments Regulation (Brussels I Recast) in respect of that claim. It will be challenging now for defendants to such claims to avoid the jurisdiction of habitual residence even in circumstances where they obtain a claimant's agreement to a jurisdiction clause specifying an alternative forum.

Background

The claimant, Ms Ang, commenced proceedings in the UK against a company incorporated in Cyprus that operated an online platform for trading Bitcoin.  As well as claiming compensation for the wrongful blocking and termination of her account, Ms Ang made certain data protection claims against Reliantco.  

Reliantco challenged the jurisdiction of the English Court on the basis that there was in place an exclusive jurisdiction agreement between the parties in favour of the courts of Cyprus.

Key issues in dispute

Reliantco contested the English court's jurisdiction on the basis that the terms and conditions in its customer agreement gave exclusive jurisdiction to the courts of Cyprus for the purposes of Article 25 of the Brussels Regulation (Recast) No 12/5/2012.  Ms Ang argued that the English court had jurisdiction on three separate grounds:

a.       Ms Ang was a "consumer" within Section 4 of the Regulation;

b.      the exclusive jurisdiction clause had not been properly incorporated into the agreement for the purposes of Article 25 of the Regulation; and

c.       the English court had jurisdiction over her GDPR claim.

Discussion
a.      Whether Ms Ang was a "consumer"

Ms Ang argued that the jurisdiction clause was ineffective because she was a "consumer" within Section 4 of the Regulation, which would allow her to bring proceedings in her Member State of domicile (i.e. the UK).

The Court considered the EU case law on the meaning of "consumer" and concluded that Ms Ang was a "consumer". In doing so, it rejected Reliantco's argument that trading in Bitcoin futures on an online platform could never amount to a consumer contract ("wealthy consumers are consumers nonetheless"). The question was not the knowledge, experience, skill or expertise of the putative consumer, but the purpose of the contract. The Court considered that whilst Ms Ang had overstated the extent of her prior experience of "trading" when providing information for her account registration, she had not created the impression that she was opening an account for business purposes.

Similarly, the Court considered it irrelevant that Ms Ang's contract with Reliantco gave her an account rather than allowing her to trade through an investment intermediary or adviser.

b.      Whether there was an effective jurisdiction clause

Owing to the Court's determination of the jurisdiction challenge on the basis of Section 4 of the Regulation, Ms Ang's alternative arguments were dealt with briefly.  She had argued that the jurisdiction clause in the terms and conditions had not been effectively incorporated into her customer agreement. According to settled case law on "click-wrapping", the critical question was whether the standard terms were reasonably accessible to Ms Ang if she wanted to check them before agreeing to them.

Ms Ang argued that they were not, as the corresponding webpage had failed to open when she created her account. However, the Court considered Ms Ang's recollection in this respect to be unreliable on the evidence before it, and that she had in any case also signed a hard copy of the contract, which sufficed to incorporate the jurisdiction clause.

c.       Jurisdiction under the GDPR

Ms Ang claimed several data protection breaches, only one of which arose under the GDPR, namely her claim for an order for rectification, destruction, erasure or blocking of her personal data still held by Reliantco. The remainder of her claims were governed by the Data Protection Act 1998.

The Court noted that the non-GDPR data protection breaches fell within the scope of the Regulation and within the scope of the jurisdiction clause. However, with respect to her one claim governed by the GDPR, Article 79(2) of the GDPR provided that Ms Ang was entitled to bring proceedings in the UK against Reliantco as data controller or processer, because that was where she was habitually resident.

The habitual residency option would, in the Court's view, have been sufficient to override the requirements of the Regulation in respect of the GDPR claim.  This was because:

  • Article 79(2) of the GDPR is unqualified by reference to any possible jurisdiction agreement;
  • Article 67 of the Regulation provides that the Regulation "shall not prejudice" provisions governing jurisdiction in specific matters which are contained in instruments of the Union;
  • Article 79 is a "provision governing jurisdiction" within the meaning of Article 67 of the Regulation;
  • therefore, Article 79 cannot be "trumped" by Article 25 of the Regulation; and
  •  Recital (147) to the GDPR also says that rules on jurisdiction in the GDPR (such as Article 79) should not be prejudiced by "general jurisdiction rules such as those of the Regulation".

Had Ms Ang not succeeded on Section 4 of the Regulation, the Court would therefore have held that it had jurisdiction only in respect of her one claim under the GDPR, meaning that Ms Ang would have had to pursue that one claim on its own before the English Court and / or amend her Particulars of Claim.

Analysis

This case is the first of its kind to confirm the unqualified nature of the provision governing jurisdiction in Article 79(2) GDPR. As the Court noted, the previous cases of Schrems v Facebook (2018) and Sabados v Facebook (2018), were decided under the 1995 Directive/1998 Data Protection Act, and so did not provide authority on this point. However, the Court has now confirmed that the jurisdiction conferred on the court of a GDPR claimant's habitual residence takes priority over the requirements of the Regulation in respect of that claim, and so it will be more difficult for defendants to such claims to avoid the jurisdiction of habitual residence even in circumstances where they obtain a claimant's agreement to a jurisdiction clause specifying an alternative forum.

Ramona Ang v Reliantco Investments Limited [2019] EWHC 879 (Comm)