The High Court has ordered Discord Netherlands BV to disclose agreed information to Digital Rights Ireland Company Limited by Guarantee (DRI) within 28 days of the order being perfected. The information is intended to help DRI identify people alleged to have posted intimate images without consent, so it can bring a representative data protection action on behalf of six women.
In a judgment delivered on 20 October 2023, Mr Justice Brian O’Moore also substituted Discord Netherlands for Discord Inc. as the sole defendant in the proceedings. The precise form of the order was to be sent to the registrar in an agreed form, and the parties could apply to the court about any outstanding matters.
DRI said it had been mandated by six women who it claimed were affected by postings on a specific web page hosted on a Discord account. The judge recorded that the application sought Norwich Pharmacal type relief: disclosure to enable intended proceedings against the people who posted the images. He stressed that DRI and the women made no complaint about Discord’s own activities.
The two Discord entities did not oppose substitution or disclosure. The judgment says material, including the relevant data, had been transferred from Discord Inc. to Discord Netherlands, which was identified as the current controller of the data. The judge said disclosure was necessary to enable the intended action and limited to information that would allow it to be brought.
The judge was satisfied, for the purposes of this application only, that DRI met the statutory description of a not-for-profit body eligible to bring a representative data protection action. He expressly said that this was not a final or binding finding.
The judgment also addressed jurisdiction. It said the six women were described as Irish data subjects and that the intended action sought damages in tort against those who posted the images. The judge concluded that the application could be brought in the Irish courts under Article 79(2) of the GDPR. He also noted that the Discord entities had agreed to the orders, despite earlier correspondence disputing Irish jurisdiction.
The ruling concerns disclosure and the procedural steps needed to enable the proposed action. It does not determine whether the alleged postings occurred, who was responsible, or the merits or outcome of any later representative action.