UK court: Long arm of GDPR can't reach California*

Image my composite of Atlantic Ocean by Tentotwo CC BY-SA 3.0

and "hand reach" from Pixabay by ArtsyBee, licensed

*[UPDATE, Jan. 30, 2022:] On December 21, 2021, the Court of Appeal allowed service on U.S. defendants without ultimately resolving the GDPR territorial scope question.  Read more from Paul Kavanaugh, Dylan Balbirnie, and Madeleine White at Dechert LLP.]

A High Court ruling in England limited the long-arm reach of European (now British) privacy law in a suite of tort claims against Forensic News, a California-based web enterprise doing "modern investigative journalism."

The complainant is a security consultant investigated by Forensic News and a witness in the U.S. Senate Intelligence Committee probe into Russian interference in the 2016 U.S. elections.  A British national, he accused Forensic News of "malicious falsehood, libel, harassment and misuse of private information," the latter based on violation of the British enactment of the European General Data Protection Regulation (GDPR).

The extraterritorial reach of the GDPR has been a hot topic lately in privacy law circles, as U.S. companies struggle to comply simultaneously with foreign and burgeoning state privacy laws, such as the California Consumer Privacy Act (CCPA).  

Forensic News has no people or assets in the UK, but the complainant tried to ground GDPR application in the news organization's website, which accepts donations in, and sells merch for, pounds and euros.  No dice, said the court; it's journalism that links Forensic to the plaintiff and to the UK, not the mail-order side show.

The case is Soriano v. Forensic News LLC, [2021] EWHC 56 (QB) (Jan. 15, 2021).  Haim Ravia, Dotan Hammer, and Adi Shoval at Pearl Cohen have commentary.

Boston Bar webinar will probe privacy law latest

Coming soon, the Boston Bar Association will host a webinar on data privacy class action litigation (and related privacy stuff too).  I'm trying to get up to speed on all of the latest developments so that I will not disappoint moderator Melanie A. Conroy, attorney and CIPP/US, of Pierce Atwood LLP, who graciously if foolhardily invited me to participate.  For The National Law Review in April, Conroy wrote the authoritative rundown on the Mount Ida student class action, which treatment inspired me to write about the case for The Savory Tort.

My task is daunting; a lot happened while I was in Africa early in the year and out of the office over the summer.  Our subject matter includes the new regulations under the California Consumer Privacy Act, burgeoning lawsuits under the Illinois Biometric Information Privacy Act, and the shock waves just now hitting the United States from the "Schrems II" decision in the European Court of Justice.  (Brush-with-greatness note: Max Schrems has been in my car.  Long story.)  That's just to get the ball rolling.

Co-panelists are Matthew M.K. Stein, of Manatt, Phelps & Phillips, LLP, and Marjan Hajibandeh, of CarGurus, Inc.  Here are the program details from the BBA:

BBA Webinar: Roundtable on Recent Developments in Data Privacy Class Action Litigation
Thursday, September 24, 2020, 10:00 to 11:00 a.m.
This webinar will explore the growing prevalence of data privacy class actions through recent developments in data privacy legislation, expanded private rights of action, biometric privacy claims, consumer data suits, post-breach and cybersecurity litigation, and the increasingly complex landscape of rulings by federal courts of appeals. The presenters will discuss national trends and developments within the First Circuit and in Massachusetts. The discussion will look ahead to areas to watch and trends that may shape the development of data privacy class actions in the coming months and years.

The program is free for BBA members and $100 for non-members. Registration at least two hours before the program-start is essential to receive the Zoom link.