This article is about a problem with the Harmful Digital Communications Act. I identify the problem and propose a solution. The solution is simple in one respect but requires engagement with the legislative process which raises complexities. Without the solution the Act may be ineffective in a number of cases.
The article addresses some rather complex issues of law which I have endeavoured to simplify as best I can. I hope that readers find the post interesting and informative.
Introduction
The Harmful Digital Communications Act 2015 (HDCA) was enacted by the New Zealand Parliament. It provides a remedial framework for people who are victims of Harmful Digital Communications.
The Act is characterised by 10 communication principles which act as a litmus test for the evaluation of electronic communications.
It provides for a civil enforcement process whereby complaints about alleged harmful communications can be dealt with in a number of ways which are primarily technological and which do not include punitive sanctions.
It provides for three offences — one of causing harm by a digital communication[1], one of posting an intimate visual recording without consent[2] and one of failing to comply with a civil enforcement order.
In this article I shall address the civil enforcement process.
Where a person considers that an online electronic communication breaches one of the ten communications principles and causes harm – defined as serious emotional distress - that person may take action in the District Court and seek up to six remedies against the person posting the communication that are set out in section 19(1) of the HDCA.
In addition an application may be made seeking up to four orders against an online content host under section 19(2) HDCA.
An online content host is defined in the HDCA as the person who has control over the part of the electronic retrieval system, such as a website or an online application, on which the communication is posted and accessible by the user.
At law a person may include a company. Entities such as Facebook and Google may fall under the definition of an online content host.
The Problem
But if the HDCA applies in New Zealand how can offshore entities like Google or Facebook be brought before the Court and be required to comply with any of the order that may be made under section 19(2) HDCA.
An answer may be provided by looking at a hypothetical scenario.
A Hypothetical Scenario
Jane is the proprietor of an online marketing business. She has been the subject of an online campaign initiated on a blog. The blogger is anonymous and the identity of the blogger cannot be ascertained. The blog alleges that Jane is a bad parent, that she abuses her children, starves her pet cat and therefore her representations on her online business site that she is an upstanding member of the community and is a reliable person in business are false and are either “misinformation” or lies.
The allegations are false and breach Communication Principle 6 of the HDCA. The blog posts have been repetitive over a period of months and could arguably be said to amount to harassment of Jane in breach of Communication Principle 5 of the HDCA.
As a result of the posts Jane has suffered serious emotional distress. She has been losing sleep, suffering from high blood pressure as a result of stress and her business has been suffering. She has attended upon a doctor and has been prescribed medication for her condition which can be clearly attributed to the posts.
Jane wishes to take action to have the posts taken down. She is required to refer the matter to Netsafe, the Approved Agency under the HDCA. She does so. Netsafe try to identify the blogger in question. They are unable to do so. However the blog platform turns out to be owned and operated by international online services provider Grumble. Netsafe is of the view that Grumble is an online content host and approach Grumble to have the material taken down. Grumble will not do so citing freedom of expression interests.
Netsafe provides Jane with a Case Summary which enables her to commence proceedings in the District Court. She names Grumble New Zealand Limited as the defendant. She seeks an order under section 19(2)(a) that Grumble take down or disable public access to the posts on their blog platform.
Grumble New Zealand Limited is a company registered in New Zealand. Its registered offices are at an Auckland law firm. It has directors based in Australia and the United States. It has one shareholder, Grumble International LLC whose offices are located in Mountainview California.
Grumble undertakes a number of business activities in New Zealand although the servers for its blog business are located off shore. Out of an abundance of caution Jane cites Grumble International LLC as a defendant as owner of the blog site.
Her application is processed and a Judge makes directions that the notice of the application be served on Grumble at the law firm which is the registered office. On behalf of Grumble NZ and Grumble International the law firm challenges the power of the Court to make an order – the technical term is to “protest the jurisdiction of the Court”. It argues that Grumble NZ has nothing to do with the blog site and that any order that may be made against Grumble International could not be enforced.
The Issue – Does the Court Have Jurisdiction
The issue is whether or not the Court would be prepared to accept Grumble’s argument.
Underneath the argument is a body of rules involving when a Court may have jurisdiction to hear a case and grant relief. When an offshore entity is involved principles of private international law or “conflict of laws” come into play.
The answer to the question raised by the issue is not easy. Like so many things in the law much depends upon the circumstances.
As a matter of principle Courts are reluctant to bring foreign parties into Court unless they have submitted to the jurisdiction – agreed to be a party to the litigation – or there is some factor linking the defendant with New Zealand that would justify bringing the foreign party into Court.
Service of Proceedings
The way in which a party may be brought before the Court is if that party is served with a notice of the proceedings.
The rules relating to service are detailed and complex. They are contained in the High Court Rules and the District Court Rules. There are other pieces of legislation that set out the way in which service may take place. An example is the Companies Act.
The Rules provide two paths for service. One is where the permission of the Court must be obtained. The other is where the case falls within the scope of one of the Rules that allows service to take place without the permission of the Court. A common feature in this latter situation is that there must be a connection between the matters at issue in the case – what is called the cause of action – and New Zealand.
Examples may be where a contract was formed in New Zealand. Or a contract was to be performed in New Zealand. Or, in the case of defamation where an element of the tort occurred in New Zealand.
Defamation as an example
Let’s look for a moment at defamation. The law says that defamatory material must be published. Publication is an element of the tort. Suppose an online publication based in the USA makes an article available that is defamatory of a New Zealander. Can the New Zealander bring an action for defamation in the New Zealand Court. On the authority of an Australian case called Dow Jones v Gutnick [2002] HCA 56, which was approved in University of Newlands v Nationwide News Pty Ltd [2005] NZCA 317 and Solicitor General v Siemer (HC CIV-2008-404-472 8 July 2008) publication takes place where the material was downloaded and comprehended. In that way an overseas publisher can be served without the permission of the Court.
In Australia Google has been cited as a defendant in several defamation cases including Duffy v Google (2017) SASFC 130 and Trkulja v Google [2018] HCA 25– cases that arose as a result of the publication of search results which were downloaded and comprehended in Australia.
The jurisdiction of the Court may be contested on certain grounds but it is more likely than not, in the defamation example discussed, service would be allowed and the Court would be able to exercise jurisdiction.
When a person seeks the permission of the Court to serve an overseas party different considerations apply. Essentially the person suing has to establish that the case is a proper one for the Court to hear and that there are sufficient grounds to justify asserting jurisdiction over an overseas party. That is a very simple explanation of a highly complex area of law.
The issue of whether an overseas party can be brought before the Court in the context of the internet has attracted a considerable amount of attention and is dealt with in different countries in different ways. Much depends on the way that the law is structured.
Overseas Examples
In Canada a company known as Equustek sought to have Google deindex references to another company which was rebranding and reselling Equustek merchandise. The issue was not so much about service. The Court had jurisdiction over Google because it carried on business in Canada. The real issue was whether the worldwide injunction that Equustek sought would be enforceable. Could the Court make an order which was extraterritorial in effect.
The principle that can be extracted from the Equustek case is that where an unlawful activity has implications that go beyond the domestic jurisdiction and, by utilising protocols or utilities enabled by the Internet, are global in nature, an extraterritorial remedy may be provided by a Court where such extraterritoriality is necessary to provide an effective remedy. Extraterritorial remedies, such as injunctions, may be available against third parties whose Internet activities directly or indirectly enable the continuation of the unlawful activity.
However it is one thing to obtain a judgement in a Court. It is another to enforce it. In the US case of Worcester v Georgia 31 US 515 (1832) where the Court decided a case with which President Andrew Jackson disagreed, Jackson is reputed to have said “John Marshall has made his decision: now let him enforce it” which illustrates the rather tenuous powers that a Court has. As Alexander Hamilton observed, remarking that the judiciary was the least dangerous branch of government,
“The judiciary . . . has no influence over either the sword or the purse; no direction either of the strength or of the wealth of the society; and can take no active resolution whatever.” (Federalist 78)
In another case, this time from the US - Microsoft Corp v US 829 F.3d 197 (2d Cir. 2016) – Microsoft operated an email server located in Ireland. Investigators sought compliance with a search warrant requiring Microsoft to disclose the emails sought. Microsoft refused, arguing that the search warrant had extraterritorial effect.
Once again the case involved the use of Internet based platforms. Although Microsoft was being required to make information available, there would be little inconvenience given the ease with which information can be accessed remotely. There was an allegation of local wrongdoing. The difference was that it was the evidence that was located outside the jurisdiction. Yet it could be argued that the use of Internet protocols in the furtherance of unlawful activity could justify the provision of an extraterritorial remedy.
However, the US Court required a clear statement of extraterritorial applicability before it would grant a remedy.
Another Canadian case involving extraterritoriality is AT v Global24H.com.[2017] FC 114. That case involved the activities of a Mr Radelescu who operated a Romanian-based website that republished public documents from a number of countries, including Canada. In particular it began publishing Canadian court and tribunal decisions which were available from Canlii. Canlii does not allow search engines like Google to index its decisions but Global24h did so with the result that an individual’s name would appear on the results if there had been a search for that name. divorce proceedings, immigration matters, health issues and personal bankruptcies.
The relief sought in the Federal Court included an order that the respondent delete from his website and servers all court and tribunal decisions that is republished containing personal information, and remove these decisions from search engines caches.
The issue was whether the legislation (Personal Information Protection and Electronic Documents Act 2000 ) had extraterritorial application to Global24h.com as a foreign based organisation.
The purpose of the legislation was considered. It was to establish, in an era in which technology increasingly facilitates the circulation and exchange of information, rules to govern the collection, use and disclosure of personal information in a manner that recognizes the right of privacy of individuals with respect to their personal information and the need of organizations to collect, use or disclose personal information for purposes that a reasonable person would consider appropriate in the circumstances.
Was there sufficient connection between Global24H and Canada. In this case it was noted that the website operator and the host server were located in Romania. Mosley J noted that “when an organization’s activities take place exclusively through a website, the physical location of the website operator or host server is not determinative because telecommunications occur “both here and there”
Other factors which were relevant were these:
1. The content of the website comprised Canadian court and tribunal decisions which contained personal information and which had been copied from Canadian legal websites
2. The websites targeting Canadians by specifically advertising that it provided access to Canadian caselaw
3. The impact of the website was felt by members of the Canadian public.
In making the order sought, the Court referred to Equustek. The Equustek orders were capable of early compliance given the centralised nature of the search engine and its operation. The orders in AT v Global24h were strongly persuasive, especially as far as search engines are concerned. They recognised that often problems that are posed by the Internet may have direct or indirect solutions on the Internet. Given the significance and importance of searchability as a quality of digital systems, to disable or impede the location of information on the Internet is a significant step in obtaining a form of compliance with the protection of individual rights to privacy, as was the case in AT v Global24h.com
Carrying On Business
It is probably becoming clear that there is no universal solution to these problems. This is further demonstrated – once again in the area of privacy law – in the Australian case of Facebook v Australian Information Commissioner [2022] FCAFC 9.
That case involved the application of the Privacy Act 1988. The Privacy Act like other Australian legislation contains a threshold for its application particularly to overseas entities. The test is whether an entity is carrying on business in Australia. In the Facebook case the issue involved an examination of how the developed “carrying on business” test should be ap[plied to Internet businesses.
The case involved Facebook and certain privacy breaches that arose from the Cambridge Analytica scandal in 2018. In Australia, the personal information of 53 Australian Facebook users and 311,074 of these users’ Facebook friends was accessed and used for the purpose of political campaigns without the authority of the users. In March 2020, arising from these privacy breaches, the Australian Information Commissioner initiated proceedings against Facebook Inc and Facebook Ireland under the Privacy Act.
Because Facebook Inc was a company located outside Australia and therefore was a ‘person in a foreign country’, the Federal Court Rules 2011 (Cth) required that permission be granted by the court before the Commissioner could serve proceedings on Facebook Inc outside the jurisdiction.
Generally, to obtain permission, it is necessary to establish a prima facie entitlement to all or part of the relief claimed.
The question of whether Facebook Inc carried on business in Australia arose because the Privacy Act only applies to acts done or practices engaged in outside Australia when done or engaged in by organisations that have ‘an Australian link’.
An Australian link exists where an organisation (defined to include a body corporate) carries on business in Australia, and it has collected or held personal information in Australia.
Very briefly the Court had to consider the question as a matter of fact.
The test requires a consideration of the particular nature of the enterprise that constitutes the business
There are three elements to the test:
Is there a business?
Is it being carried on?
Is there a territorial link; that is, if a business is being carried on, is it being carried on in Australia?
I do not intend to discuss the reasoning of the Court in detail. Suffice to say that within the context of the Privacy Act there was little doubt that Facebook was indeed carrying on business within the scope of the test.
Facebook argued strenuously against the test, suggesting that it would open the floodgates (a term beloved by lawyers when new concepts threaten) that the physical realities of their operation were all off-shore and that the systems that they employed made it clear that they were gathering data in Australia. As was the case in Equustek where Google gathered information on its users search behaviour which was an integral part of its business, Facebook’s data gathering activities were similar.
What the Facebook case demonstrates is that the development of technology has enabled some companies to operate global internet-based businesses. A focus by courts on the reality of these businesses, even though the businesses may be structured using multiple companies in a corporate group where this structure bears little resemblance to the actual operation of the business, and even though in some cases the adoption of these structures might potentially have the effect (if not also the purpose) of avoiding national laws, means that it will be more likely that national laws will apply where business activities are conducted in the jurisdiction by foreign entities.
Returning to Jane’s Case
So back to the HDCA question – can Grumble challenge the ability of the Court to exercise jurisdiction over it by allowing or validating service.
Part of the issue involves Grumble’s corporate structure. Grumble NZ is a separate corporate personality from Grumble International LLC.
Grumble NZ is not involved in the management, control or delivery of the blog site owned and operated by Grumble International LLC.
In the case of A v Google New Zealand Limited [2012] NZHC 2352 the question was the responsibility of a search engine service provider for the content of information on third party websites accessed from search results. The case involved an application for summary judgement.
Defamatory material had been published about the defendant on websites which could be accessed through search results accessed through the internet domain name www.google.co.nz. The search results included reference to the defamatory material, and link to the third party website.
The defendant was (and still is) a company incorporated in New Zealand in 2006. It was an indirect subsidiary of Google Inc incorporated in the US and having its primary place of business in California. Google Inc owns and operates what is known as the Google search engine, which allows the public to inquire about information on any topic, identifies websites containing information on that topic, retrieves information from that website, and reproduces extracts of that information in its search results.
The plaintiff sought orders that Google NZ remove or block access to the offending websites.
In answer Google NZ argued that it was the wrong party. In support of this it stated:
1. It did not own or control the google.co.nz domain name
2. It did not operate, control or provide the search services accessible at www.google.co.nz
3. It did not have the ability to operate, control or direct the functioning of the Google search service or control or direct action in respect of blocking URLs from the search results page
4. It did not have access to the technology used to operate control or provide the Google search service
5. Therefore it has no responsibility for the Google search service or the results thereof.
It was clear that the overseas entity owned and operated the search engine. The plaintiff argued that there was “sufficient connection” between the overseas entity and the local company.
The Court held on the evidence that the operation and control of the search engine resided with Google Inc and not the defendant. For this reason summary judgement could not be entered against Google.
The Court did note that Google Inc had informed the plaintiff of steps that he can take to request removal of identified URLs on an ongoing basis and that it will respond to those requests.
Although A v Google was a case about defamation and Jane’s case is under the HDCA a similar approach may be available to Grumble.
Grumble New Zealand has nothing to do with the operation or control of the blog site. Its function is to look after advertising and other commercial aspects of Grumble’s operation in New Zealand. Control and management of the blog site is in the hands of Grumble International LLC.
So can Grumble International LLC be subject to the jurisdiction of the Court under the HDCA? It here that matters get complicated.
First, the HDCA does not have a provision in it like the Australian Privacy Act that allows an examination of whether Grumble International LLC is carrying on business in New Zealand. The only way that the Grumble operation may be involved in this case is because it is an online content host.
An online content host is defined as the person who has control over the part of the electronic retrieval system, such as a website or an online application, on which the communication is posted and accessible by the user.
Clearly Grumble New Zealand does not fall within that definition. But Grumble LLC as owner and operator of the blog site could.
But the HDCA and Rules do not provide for service of proceedings on an overseas entity as defendant. Rule 34 and following of the HDC Rules set out the provisions for service – by personal service or upon a lawyer accepting service on behalf of a client or electronically.
The Court may make directions as to service. If the directions differ from the HDCA Rules, the Court directions prevail.
Rule 49 of the HDCA Rules states that if in the course of proceedings under the Act, a situation arises that is not provided for by the rules, any relevant provisions of the District Courts Rules 2014 apply.
Thus service can be considered under Part 6 of the District Court Rules. Because Grumble International LLC does not have a business presence in New Zealand the rules relating to service out of New Zealand would apply.
The case does not fall within the scope of the Rule which allows service outside New Zealand without the permission of the Court.
So the issue would have to be considered under the Rule where the Court may grant leave (permission) on the application of the plaintiff. It would be for the plaintiff applicant to establish:
(a) the claim has a real and substantial connection with New Zealand; and
(b) there is a serious issue to be tried on the merits; and
(c) New Zealand is the appropriate forum for the trial; and
(d) any other relevant circumstances support an assumption of jurisdiction.
One of the factors that might be considered under (d) would be the purpose and objectives of the legislation which was specifically designed to deal with electronic and online communications which take place within a “virtual” environment.
Furthermore the orders under section 19(2) do not have any financial, punitive, monetary or proprietorial consequences. The orders are largely technical and remedial.
Grumble would have a right to be heard in such a case and would probably argue against the Court assuming jurisdiction.
This rather intricate discussion leads to the point where Grumble International LLC may be amenable to the Court’s jurisdiction under the HDCA. But there are other considerations:
1. Arguing the jurisdictional question and the obtaining of permission to serve an overseas defendant is a complex and expensive process potentially involving fees in the thousands of dollars.
2. Many applications under the HDCA are made by self-represented parties who would be very unlikely to be able to negotiate the legal minefield of obtaining permission to serve off shore if they understood that such a minefield existed in the first place.
3. Although some Judges have made directions as to service upon a local entity of an Internet multi-national, and have even made “without notice” orders it is doubtful that service in such a case would be valid. There is a view that the purpose of service is to bring the proceeding to the notice of the defendant and that service on a local subsidiary would be drawn to the attention of the offshore parent.
That approach has an attraction were it not for the fact that service on an offshore parent isn’t just a matter of notice but involves a wider consideration of the jurisdiction of the Court and the ability to require the involvement of a party not resident in New Zealand.
Solution
One of the purposes of the HDCA is to provide victims of harmful digital communications with a quick and efficient means of redress.
Complicated rules as to service of offshore entities frustrate that purpose.
A possible solution may lie in redefining an “online content host” to read as follows:
online content host, in relation to a digital communication, means the person or entity who carries on business in New Zealand either directly or through a subsidiary and who has control over the part of the electronic retrieval system, such as a website or an online application, on which the communication is posted and accessible by the user.
The Rules relating to service of an offshore online content host could be amended by allowing service without leave of the Court upon an offshore online content host at that entity’s normal or principle place of business.
[1] Harmful Digital Communications Act 2015, s 22.
[2] Harmful Digital Communications Act 2015, s 22A