[1] Criminal and regulatory laws have varying territorial reach depending on factors like location of users, activity type, and targeted locations. [2] Civil liability also has cross-border implications regarding applicable substantive laws, adjudicative jurisdiction of courts, and choice of applicable law depending on concepts like territoriality of laws and targeting. [3] Investigatory powers of law enforcement investigating online crimes have unclear territorial scope, raising issues around direct orders to disclose data versus mutual legal assistance treaties. Comity between jurisdictions is an important consideration.

1. Internet jurisdiction primer
SCL Tech Law Futures conference
London, 10 November 2016
Graham Smith
Partner, Bird & Bird LLP
@cyberleagle

2. The Problem
Inherent exposure to multiple jurisdictions

3. Here, there or everywhere?
Page 3
UGC
(dynamic content)Users
UGC
(dynamic content)
Users
Users
Users
Site operator
Server

4. Here, there or everywhere?
Page 4
UGC
(dynamic content)Users
UGC
(dynamic content)
Users
Users
Users
Site operator
Server
Multiple connecting factors
Location/nation
ality/residence
Activity type
Operator? Storage?
Server(s)? Processing?
Actual users? Publication?
Potential users? Communication?
Targeted locations? Use?
Wronged party? Service provision?
Type of liability
Criminal/Regulatory
Investigatory powers
Civil liability (jurisdiction, applicable
law, remedies)

5. Page 5Page 5
© Bird & Bird LLP 2016
[1] Criminal/Regulatory
[2] Civil liability
[3] Investigatory Powers

6. Page 6Page 6
© Bird & Bird LLP 2016
[1] Criminal/Regulatory
Territorial reach
of substantive law
and its enforcement

7. Criminal

8. Page 8
Some cross-border criminal cases
Felix Somm
Tim Koogle
Peter Dicks
David Carruthers
Gary Kaplan
David Drummond
Peter Fleischer
Richard O'Dwyer
Kim Dotcom

9. Page 9
Why and when?
Indecent images (DE, 1995)
Nazi memorabilia (FR, 2000)
Online betting (USA, 2006)
Data protection (IT, 2008)
Copyright (USA, 2010)
Copyright (USA, 2012)

10. Regulatory

11. Page 11
Cross-border regulatory
France and the ‘right to be forgotten’ – worldwide search engine
delisting
Google’s response

12. Page 12Page 12
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
• Territoriality of substantive law
• Adjudicative (courts) jurisdiction
• Applicable law

13. Page 13Page 13
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
• Territoriality of substantive law

14. Page 14Page 14
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
Territoriality of substantive law
Different laws have different reach

15. Page 15Page 15
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
Territoriality of substantive law
Different laws have different reach
Receipt v Targeting v Origin

16. Page 16
Substantive territoriality – country of receipt
Subject Country of receipt
Defamation
(internet)
UK: where statement read and comprehended (for
defamation) (Lewis & Ors v King [2004] EWCA
Civ 1329)
Misuse of private
information
Publication to viewers on computer screens in UK
takes place in UK (Vidal-Hall v Google Inc [2014]
EWHC 13)
Data Protection
(monitoring)
Of data subjects who are within EU by a person
established outside EU:
"monitoring of their behaviour as far as their
behaviour takes place within the Union" (GDPR Art
2(b))

17. Page 17
Substantive territoriality - targeting
Subject Targeting
Trade marks Online use: (1) sale or (2) targeted offer for
sale/advertising L'Oreal v eBay (CJEU Jul 2011)
Copyright Distribution right: targeting Titus Donner (CJEU Jun
2012), Knoll (CJEU May 2015, advertisement) but NB
Blomqvist (CJEU Feb 2014, sale sufficient).
Making available right: targeting EMI v BSkyB; FAPL v
BSkyB [2013]
Database right Making available: targeting (plus country of server?)
Football Dataco v Sportradar (CJEU October 2012);
Patent Offer for sale in UK – targeting (Boegli-Gravures v
Darsail-Asp [2009] EWHC 2690 (Pat))
Data protection
(offering goods or
services)
Mere accessibility is insufficient; whether it is
apparent that controller/processor envisages offering
services to data subjects in one or more EU MS. (GDPR
Rec 23)

18. Page 18
Substantive territoriality - country of origin
Title Scope Source
Electronic
Commerce
Directive
(EU harmonised)
Disapplies applicable domestic law for
incoming services if stricter than
service provider’s EU Member State of
establishment
eDate/Martinez CJEU Oct 2011
NB exceptions e.g data protection, IP
rights, consumer contracts
EU Internal Market
(freedom of
movement of
services)

19. Page 19Page 19
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
• Territoriality of substantive law
• Adjudicative (courts) jurisdiction
• Applicable law

20. When can a court take
jurisdicion?

21. Page 21
Adjudicative – country of receipt
Subject Country of receipt
Tort
(e.g. defamation,
privacy,
trade marks,
copyright)
Article 7(2) Brussels Recast Regulation –
courts of place where damage is suffered (Shevill v
Presse Alliance, eDate/Martinez, Wintersteiger ,
Pinckney, Pez Hejduk)
● Pez Hejduk (Jan 2015) Website merely available in
copyright claimant's country
● not dependent on type of copyright infringement engaged

22. Page 22
Adjudicative - targeting
Subject Targeting
Consumer contracts Article 17 Brussels Recast Regulation
Proceedings against consumer only in courts of Member
State of consumer's domicile, if:
- a person who pursues commercial or professional activities
in the Member State of the consumer’s domicile; or
- by any means directs such activities to that Member
State or to several States including that Member
State; and
- the contract falls within the scope of such activities
Pammer/Hotel Alpenhof CJEU 7 Dec 2010

23. When can/should a court issue
an extraterritorial injunction?

24. Page 24
Extraterritorial injunction
Equustek v Jack (Google Inc, 3rd party)
British Columbia Court of Appeal 11 June 2015 (under appeal to SCC)
● Breach of confidence and passing off
● Canadian defendant evading jurisdiction
● Interim injunction requiring Google to delist D’s
website worldwide
● Numerous amicus briefs in SCC appeal

25. Page 25Page 25
© Bird & Bird LLP 2016
[2] Civil liability
Cross-border reach
• Territoriality of substantive law
• Adjudicative jurisdiction
• Applicable law

26. Page 26
Applicable law - targeting
Subject Targeting
Consumer contracts Article 6 Rome I Regulation
[Mandatory] law of consumer's habitual residence, if:
- by any means directs [commercial or professional
activities] activities to that Member State or to
several States including that Member State;
Must be interpreted harmoniously with Brussels Regulation
(Recital (24))

27. Page 27Page 27
© Bird & Bird LLP 2016
[3] Investigatory powers
What is (or should be)
the territorial reach
of law enforcement's powers to
make intermediaries disclose
user communications and data?

28. Page 28Page 28
© Bird & Bird LLP 2016
[2] Investigatory powers
• Interception (real time)
• Interception (stored communications)
• Communications data demands
• Data retention and preservation
• Evidence production orders
• Equipment interference
• Decryption powers
Etc…

29. Page 29Page 29
© Bird & Bird LLP 2016
[2] Investigatory powers
MLAT v Direct
MLAT
MLAT
RIPA
Investigatory
Powers Bill

30. Belgium and Yahoo! – Direct v MLAT
Page 30
Public
prosecutor
Court
Law
4. Fine:
€55,000 +
€10,000
per day
Belgium Supreme Court:
Cross-border demand valid
under Belgian law; Yahoo!
required to comply.

31. Page 31
Direct v MLAT
US Asst. Attorney General to US Senate President, 15 July 2016

32. Page 32Page 32
© Bird & Bird LLP 2016
[2] Investigatory powers
Microsoft warrant case
(U.S. 2nd Circuit Ct.App., 14 July 2016)

33. Investigatory powers
Page 33
MSN e-mail user
(location/nationality unknown)
Server
(subscriber
data)
Microsoft Corp
Microsoft
Ireland
Server
(content)

34. Page 34Page 34
© Bird & Bird LLP 2016
Microsoft warrant case
Focus of statute is privacy of stored communication
Invasion of privacy takes place
where content would be accessed (Dublin)
By Microsoft as agent for US government
Warrant execution would be extraterritorial
The statute did not empower that

35. Page 35Page 35
© Bird & Bird LLP 2016
A cross-cutting issue:
jurisdictional self-restraint

36. Page 36Page 36
© Bird & Bird LLP 2016
CNIL response to
Google's geoblocking proposal
Effectiveness of local law is paramount

37. Page 37Page 37
© Bird & Bird LLP 2016
"Our conclusion today also serves the interests of comity ….
Admittedly, we cannot be certain of the scope of the obligations
that the laws of a foreign sovereign - and in particular, here, of
Ireland or the E.U. - place on a service provider storing digital data
or otherwise conducting business within its territory.
But we find it difficult to dismiss those interests out of hand on the
theory that the foreign sovereign’s interests are unaffected when a
United States judge issues an order requiring a service provider to
“collect” from servers located overseas and “import” into the
United States data, possibly belonging to a foreign citizen, simply
because the service provider has a base of operations within the
United States."
Microsoft warrant case
Policy considerations - comity

38. Page 38Page 38
© Bird & Bird LLP 2016
"It will often be tempting to attempt to protect American interests
by extending the reach of American law and undertaking to
regulate conduct that occurs beyond our borders. But there are
significant practical and policy limitations on the desirability of
doing so.
We live in a system of independent sovereign nations, in which
other countries have their own ideas, sometimes at odds with ours,
and their own legitimate interests. The attempt to apply U.S. law to
conduct occurring abroad can cause tensions with those other
countries, most easily appreciated if we consider the likely
American reaction if France or Ireland or Saudi Arabia or Russia
proclaimed its right to regulate conduct by Americans within our
borders." (Lynch C.J., concurring Opinion)
Microsoft warrant case
Policy considerations – the golden rule

39. Is comity enough?

40. Page 40Page 40
© Bird & Bird LLP 2016
Equustek – comity and freedom of expression

41. Page 41Page 41
© Bird & Bird LLP 2016
Peaceful co-existence or
arms race?

42. Thank you
Graham Smith
graham.smith@twobirds.com
@cyberleagle
Bird & Bird is an international legal practice comprising Bird & Bird LLP and its affiliated businesses. www.twobirds.com