SMO (a child represented by Anne Longfield as litigation friend) acting as a representative claimant pursuant to CPR 19.6 v TikTok Inc.
| Jurisdiction | England & Wales |
| Judge | Mr Justice Nicklin |
| Judgment Date | 08 March 2022 |
| Neutral Citation | [2022] EWHC 489 (QB) |
| Docket Number | Case No: QB-2020-004688 |
| Year | 2022 |
| Court | Queen's Bench Division |
[2022] EWHC 489 (QB)
IN THE HIGH COURT OF JUSTICE
QUEEN'S BENCH DIVISION
MEDIA & COMMUNICATIONS LIST
Royal Courts of Justice
Strand, London, WC2A 2LL
THE HONOURABLE Mr Justice Nicklin
Case No: QB-2020-004688
Charles Ciumei QC and Helen Morton (instructed by Scott + Scott UK LLP) for the Claimant
Anya Proops QC, Christopher Knight and Zac Sammour (instructed by Hogan Lovells International LLP) for the Second Defendant
Hearing date: 1 March 2022
Approved Judgment
There are three applications by the Claimant before the Court. Two Application Notices were issued by the Claimant on 22 February 2022. In combination, they sought:
i) permission to serve the Claim Form on the Defendants who are domiciled outside England & Wales and, in respect of whom permission to serve out is required;
ii) an extension of the period within which to serve the Claim Form on the Defendants who have not yet been served; and
iii) permission to serve the Claim Form by alternative means on the First, Fourth, Fifth and Sixth Defendants by service on solicitors who have acted for the Defendants but who have confirmed that they are not authorised to accept service of the Claim Form.
The claim has several unusual features. The Claimant is a child, under the age of 16. Her litigation friend is the (now former) Children's Commissioner for England. As described in her claim, this is a representative claim sought to be brought by the Claimant for herself and on behalf of a class of children who use or have used TikTok, the social media platform. It is alleged by the Claimant that the six Defendants are responsible for processing the personal data of the children and for invading their privacy and misusing the children's private information.
The Claimant's representative claim is brought on behalf of a class of children, namely all those who are, or were, account holders and users of TikTok from 25 May 2018, who were (a) resident in the UK or the European Economic Area (“EEA”); and (b) under the “ relevant age”, defined as follows: (i) in the UK, under 13 years old when they used TikTok, whether or not they subsequently reached the age of 13 (pursuant to s.9 Data Protection Act 2018 (“ DPA 2018”)); or, (ii) in relation to Children in the EEA, under 16 years old when they used TikTok, whether or not they subsequently reached the age of 16 or any lower age provided by law in the Member State in which they were resident at the time of using TikTok (pursuant to Art.8(1) of the General Data Protection Regulation (“GDPR”)).
The Claim Form was issued on 30 December 2020. The date is of potentially some significance as I shall explain further below.
Prior to issue of the Claim Form, the Claimant made an ex parte application seeking her anonymisation. The Application Notice seeking that order was filed shortly after 4pm on Sunday 20 December 2020. Monday 21 December 2020 was the very last day of the legal term. The urgency, the Judge was told, stemmed from the fact that the Brexit transition period ended on 31 December 2020. This would bring about changes to the law relevant to the claim. Two changes were identified. The first related to the GDPR. The Claimant submitted that, if the Claim Form was issued prior to 1 January 2021, the English Court would have jurisdiction over the Second Defendant in respect of the class of members in the EEA. After that date the position was “ less clear”. The second change was that, if the Claim Form was issued prior to 1 January 2021, the Claimant would be able to serve the Third Defendant without requiring the Court's permission. The third point was identified to the Judge in the following terms:
“Further, and crucially, if these intended proceedings are issued prior to 1 January 2021, any judgment given is enforceable in Member States without further procedures. If the proceedings are issued from 1 January 2021 onwards, local laws of each Member State will apply which could severely impact and/or prejudice to Claimant's ability to enforce.”
The Judge directed a hearing – in the vacation – on 30 December 2020 and handed down judgment that same day [2020] EWHC 3589 (QB). The Claimant was represented by the same solicitors and Counsel as the hearing before me. The Judge granted the Claimant anonymity in the proceedings for the reasons explained in the judgment. He was critical of the last-minute nature of the application launched by the Claimant – see [7]–[11] – but in the end he was prepared to hear the application.
Having been granted permission to anonymise the Claimant, the Claim Form was issued on 30 December 2020. The Claim Form identifies six Defendants.
i) The First Defendant is a company incorporated in California, USA. The Claimant alleges that it is named as a data controller which processes personal data in the TikTok Privacy Policy dated October 2019. The Claimant's case is that for at least the early part of the period of the claim, the First Defendant was a data controller of personal data of the class of children sought to be represented by the Claimant.
ii) The Second Defendant is an English company with a place of business in London. 1 The Second Defendant is alleged to own 100% of the share capital in the Third Defendant, a company incorporated in the Republic of Ireland with a place of business in Dublin. The Claimant alleges, based on the TikTok Privacy Policy dated 5 October 2021, that the Second and Third Defendants are joint data controllers and that they process personal data in the UK and EEA respectively. The Claimant's case is that the Second Defendant is registered with the Information Commissioner's Office as a data controller, having registered from 13 October 2020. The Data Protection Officer of the Second Defendant alleged to be the Third Defendant. The Claimant has stated that, at least for the period January 2019 to July 2020, the Second Defendant “ may not have been a data controller”. The Privacy Policies between January 2019 – July 2020 stated that TikTok was provided and controlled by the First Defendant.
iii) The Fourth Defendant is incorporated in the Cayman Islands and is said to be the “ ultimate parent holding company of the Bytedance group”. It is alleged to be the ultimate parent of the Second Defendant. In this role, it is contended that “it must be assumed that the [Fourth Defendant] makes, or is involved in making, global decisions affecting the manner of collection and use of the Children's personal data and private information”.
iv) The Fifth Defendant is a privately held company headquartered in Beijing, China. The Claimant contends that it is to be inferred that the Fifth Defendant “ owns and/or otherwise controls” the First and Sixth Defendants. It is alleged
that the TikTok algorithm, said to responsible for TikTok's “ competitive advantage and global success”, is owned by the Fifth Defendant, which is alleged to be the “ epicentre of the Bytedance Group”. On this basis it is said that it is “ reasonably to be inferred” that the Fifth Defendant is also a data controller of the Children's personal data and/or private information.v) The Sixth Defendant is an exempted company with limited liability incorporated under the laws of the Cayman Islands, with its principal place of business in Shanghai, China.
As will be apparent, only the Second Defendant is domiciled within the jurisdiction of the Court. Therefore, from the point of issue of the Claim Form, the Claimant's solicitors were aware that they needed to apply for permission to serve the Claim Form on, at least, the First, Fourth, Fifth and Sixth Defendants (“the Service Out Defendants”). A claimant who needs to serve a Claim Form out of the jurisdiction has 6 months to do so from the date of issue: CPR 7.5(2).
After the Claim Form was issued, no application was made seeking permission to serve the Claim Form out of the jurisdiction on the Service Out Defendants. Instead, on 31 December 2020, the Claimant sent a 27-page letter of claim to all Defendants. No pre-action protocol letter had been sent to the Defendants or any of them. The Claimant's solicitors suggested in their letter that they had issued the Claim Form, without the customary and required pre-action correspondence, “ in order to facilitate the step… to the making of Court orders for anonymity and a confidentiality ring”. The letter identified the basis of the Claimant's claim and invited the non-English companies to accept service without the need for the Claimant to obtain permission to serve out of the jurisdiction. The letter requested a response by 28 January 2021. The Claimant's solicitors stated that it was “ not appropriate” to serve the Claim Form that they had issued the day before, “ in particular” because the Supreme Court was due to hear an appeal in Lloyd v Google in April 2021. The Claimant's solicitors invited the Defendants to agree a stay until the Supreme Court had given its judgment in Lloyd v Google. I need to explain a little about those proceedings.
Mr Lloyd had brought a claim against Google Inc for alleged breached of the Data Protection Act 1998. Google Inc was a Delaware corporation. As such, the claimant needed the court's permission to serve the Claim Form on Google outside the jurisdiction. The application for permission had been contested by Google on the grounds that the claim had no real prospect of success as: (1) damages could not be awarded under the DPA 1998 for “ loss of control” of data without proof that it caused financial damage or distress;...
To continue reading
Request your trial
-
Ethan Thomas Wragg and Others v Opel Automobile GmbH
...Al-Zahra per Haddon-Cave LJ at [79]; Sodastream Ltd v Coates [2009] EWHC 1936 (Ch) per Blackburne J at [50(9)]; SMO v Tik Tok Inc [2022] EWHC 489 (QB) per Nicklin J. at [93]. iv) Where the effect of an extension might prejudice any limitation defence available to the defendant, a claimant......
-
SMO v TikTok: representative actions post Lloyd v Google
...(A Child) v Tiktok Inc. & Ors [2022] EWHC 489, the High Court considered an alternative basis for bringing a representative claim for loss of control under the GDPR and the Data Protection Act 2018 (DPA 2018) following the Supreme Court’s decision in Lloyd v Google. This case is a pre-Lloyd......
-
SMO v TikTok – Another UK Representative Action Survives, For Now
...since they ca n potentially byp ass some of the issues p osed by the Supr eme Court’sdecision in Lloyd, we may see a resurg ence. [1] [2022] EWHC 489 (QB).[2] [2021] UKSC 50 XX Meet Our Team Contact UsMadeleine V. Findleymfindley@jenner.com | Download V-Card Tracey Lattimertlattimer@jenner.......
-
Five Years Of The GDPR ' A Five Point Reflection
...jury is out, noting that other large representative class actions have also been discontinued, most notably the case ofSMO v TikTok [2022] EWHC 489 (QB)issued prior to the outcome of Lloyd due to perceived procedural advantage relating to Brexit. Whilst SMO had the potential to consider the......
-
The Weekly Roundup: The 100th Edition
...copious proceedings were issued prematurely to secure the jurisdiction of the English and Welsh courts. SMO v TikTok Inc (and Ors) [2022] EWHC 489 (QB) is one such case. It provides a useful reminder of the issues that can arise in respect of service out of the jurisdiction, as well as the ......