Global menu

Our global pages


High Court grants a Norwich Pharmacal Order (“NPO”) requiring Facebook to disclose the identity of an unknown person suspected of wrongfully requesting the deletion of a deceased user’s account

  • United Kingdom
  • Financial services disputes and investigations
  • Litigation and dispute management - Norwich Pharmacal Orders



Azra Sabados v Facebook Ireland [2018] EWHC 2369

Facts of the case

– The Claimant, a Facebook user based in London, had an intimate, long-distance relationship with another Facebook user, Mirza Krupalija (“M”), based in Bosnia. The couple would communicate regularly via Facebook and M used the platform to post photos of them both.

– Following M’s death in 2016, Facebook received and acceded to a request from a person unknown (the “Possible Defendant”) to delete M’s account, resulting in the irrecoverable deletion of all posted material and causing severe distress to the Claimant. Upon request, Facebook declined to disclose the identity of the Possible Defendant, stating that all of its normal processes had been followed, and that such a request could only have been made by an executor or immediate family member. The Claimant suspected, however, that the Possible Defendant may have been posing as such.

– The Claimant argued that: (i) M’s Facebook page contained her own personal data in the form of their intimate messages as well as photos of her, and the deletion of the account therefore constituted a breach by the Possible Defendant of the Data Protection Act 1998; and (ii) given that the Possible Defendant had convinced Facebook of their authority to request the deletion, there had potentially been access by the Possible Defendant to her personal data and private messages to M, and that this constituted a possible breach of confidence and/or misuse of private information.

– The Claimant sought a NPO against Facebook to discover the identity of the Possible Defendant, with a view to bringing legal action against him/her.

The decision

– HHJ Parkes QC was satisfied that there was an arguable case that England was the place “where the harmful event occurred”, and that the English Court therefore had jurisdiction to grant a NPO against Facebook under Art. 7(2) of the Brussels Recast Regulation (Regulation 1215/2012), as well as hear the substantive action.

– Referring to the test summarised in Ramilos Trading Ltd v Buyanovsky [2016] EWHC 3175 (Comm) (see our briefing on this case on page 12 of the May 2017 edition of the ESCOU), HHJ Parkes QC granted a NPO on the basis that:

1) there was a good arguable case that the Possible Defendant had committed a breach of the Data Protection Act 1998 and/or breach of confidence or misuse of private information;

2) the NPO was required in order for the Claimant to identify the Possible Defendant and know what representations they made to Facebook, so as to be able to bring a claim against them; and

3) Facebook: (i) had facilitated the deletion and was mixed up in the alleged wrongdoing (although no wrongdoing was found on Facebook’s part); and (ii) was potentially in a position to provide the requested information.

Analysis and practical advice

– HHJ Parkes QC conceded that the question of jurisdiction was not one he had found easy to determine, and that he was concerned with the proposition that the Claimant could found jurisdiction by suffering distress in this country, in respect of actions which in all other respects took place in the Republic of Ireland (being the place where Facebook received and acted on the request for deletion) and possibly also Bosnia (being the place where M lived and worked and with which the Claimant had very strong bonds). 

– However, HHJ Parkes QC ultimately granted the NPO because he could see no reason of principle why he should not conclude that there was an arguable case that the harm occurred in England, given this is where the Claimant lives and accordingly the place where she suffered the distress as a result of the actions of the Possible Defendant. Nevertheless, given that this was a short hearing at which Facebook did not appear, it may be that this decision is not the last word on the issue.

– As regards a potential intrusion into the Possible Defendant’s data protection rights and rights to privacy under Art.8 of the ECHR, HHJ Parkes QC considered that this was mitigated by: (i) the implied undertaking that the Claimant should not use the disclosure provided under the NPO for any purposes other than the possible substantive action; and (ii) the fact that the Court could decide on further safeguards at a later stage as appropriate.