![]() |
[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback] [DONATE] | |||||||||
England and Wales High Court (Administrative Court) Decisions |
||||||||||
PLEASE SUPPORT BAILII & FREE ACCESS TO LAW
To maintain its current level of service, BAILII urgently needs the support of its users.
Since you use the site, please consider making a donation to celebrate BAILII's 25 years of providing free access to law. No contribution is too small. If every visitor this month gives just £5, it will have a significant impact on BAILII's ability to continue providing this vital service.
Thank you for your support! | ||||||||||
You are here: BAILII >> Databases >> England and Wales High Court (Administrative Court) Decisions >> Ordanduu GmbH & Anor, R (On the Application Of) v Phonepayplus Ltd [2015] EWHC 50 (Admin) (16 January 2015) URL: https://www.bailii.org/ew/cases/EWHC/Admin/2015/50.html Cite as: [2015] EWHC 50 (Admin) |
[New search] [View without highlighting] [Printable RTF version] [Help]
QUEEN'S BENCH DIVISION
ADMINISTRATIVE COURT
Strand, London, WC2A 2LL |
||
B e f o r e :
____________________
THE QUEEN on the application of (1) ORDANDUU GmbH (2) OPTIMUS MOBILE GmbH |
Claimants |
|
- and - |
||
PHONEPAYPLUS LIMITED |
Defendant |
____________________
WordWave International Limited
A Merrill Communications Company
165 Fleet Street, London EC4A 2DY
Tel No: 020 7404 1400, Fax No: 020 7831 8838
Official Shorthand Writers to the Court)
Tim Ward QC (instructed by Messrs Bates, Wells & Braithwaite LLP) for the Defendant
Hearing dates: 18, 19 November & 16 December 2014
____________________
Crown Copyright ©
Mr Justice Supperstone :
Introduction
i) The process was unfair because the Claimants' received no notice of the Defendant's intention to direct that their businesses be suspended and their revenues frozen, and had no opportunity to make representations, despite the Defendant taking nine days to implement the procedure;
ii) The measures were disproportionate, in particular because they were not suitable for attaining, or rationally connected to, the objective of protecting consumers and in any event went beyond the least restrictive means necessary to achieve that objective; and
iii) For that reason and others, they did not comply with Article 3 of Directive 2000/31/EC ("the Directive"), as implemented by the Electronic Commerce (EC Directive) Regulations 2002 ("the 2002 Regulations"), and amounted to an unlawful restriction on the Claimants' freedom to provide services under Article 56 of the Treaty on the Functioning of the European Union ("TFEU").
The Legal Framework
The Treaty on the Functioning of the European Union ("TFEU")
"Within the framework of the provisions set out below, restrictions on freedom to provide services within the Union shall be prohibited in respect of nationals of Member States who are established in a Member State other than that of the person for whom the services are intended."
Directive 2000/31/EC on Electronic Commerce ("the Directive")
"1. Each Member State shall ensure that the information society services provided by a service provider established on its territory comply with the national provisions applicable in the Member State in question which fall within the co-ordinated field.
2. Member States may not, for reasons falling within the co-ordinated field, restrict the freedom to provide information society services from another Member State."
"Member States may take measures to derogate from paragraph 2 in respect of a given information society service if the following conditions are fulfilled:
(a) the measures shall be:
(i) necessary for one of the following reasons:
- public policy, in particular the prevention, investigation, detection and prosecution of criminal offences, including the protection of minors and the fight against any incitement to hatred on the grounds of race, sex, religion or nationality, and violations of human dignity concerning individual persons,
- the protection of public health,
- public security, including the safeguarding of national security and defence,
- the protection of consumers, including investors;
(ii) taken against a given information society service which prejudices the objectives referred to in point (i) or which presents a serious and grave risk of prejudice to those objectives;
(iii) proportionate to those objectives;
(b) Before taking the measures in question and without prejudice to court proceedings, including preliminary proceedings and acts carried out in the framework of criminal investigation, the Member State has:
- asked the Member State referred to in paragraph 1 to take measures and the latter did not take such measures, or they were inadequate,
- notified the Commission and the Member State referred to in paragraph 1 of its intention to take such measures."
"Member States may, in the case of urgency, derogate from the conditions stipulated in paragraph 4(b). Where this is the case, the measures shall be notified in the shortest possible time to the Commission and to the Member State referred to in paragraph 1, indicating the reasons for which the Member State considers that there is urgency."
"Without prejudice to the Member State's possibility of proceeding with the measures in question, the Commission shall examine the compatibility of the notified measures with Community Law in the shortest possible time; where it comes to the conclusion that the measure is incompatible with Community Law, the Commission shall ask the Member State in question to refrain from taking any proposed measures or urgently to put an end to the measures in question."
The Electronic Commerce (EC Directive) Regulations 2002 ("the 2002 Regulations")
Communications Act 2003 ("the 2003 Act")
PhonepayPlus Code of Practice ("the Code")
"Save as is provided below, this Code applies to all premium rate services which are accessed by users in the United Kingdom or provided by a Level 1 or Level 2 provider which is situated in the United Kingdom."
"The outcomes which premium rate services are expected to achieve are set out below. They are followed by sets of rules which have to be complied with.
References to premium rate service or services in this Code include all aspects of a service including content, promotion and marketing and any technical matters including those relating to the delivery and quality of sound or picture.
Level 2 providers have responsibility for achieving these outcomes by complying with the rules in respect of the provision of the relevant premium rate service. All Network Operators and Level 1 providers involved in providing premium rate services must take all reasonable steps in the context of their roles to ensure the rules are complied with."
"assess the potential risks posed by any party with which they contract in respect of, inter alia, the promotion, marketing and content of the premium rate services which they provide or facilitate and take and maintain reasonable continuing steps to control those risks."
"4.5.1 In appropriate cases where an apparent breach of the Code has taken place which is serious and requires urgent remedy, PhonepayPlus will use the Emergency procedure:
(a) PhonepayPlus will conduct an immediate preliminary investigation;
(b) On completion of its preliminary investigation, PhonepayPlus will notify its findings to three members of the CCP [the Code Compliance Panel]. The three people notified will decide whether the situation is sufficiently serious and urgent to warrant the use of the Emergency procedure;
(c) If all three people agree on the use of the Emergency procedure, PhonepayPlus will:
(i) Use its best endeavours to inform the relevant party that its service appears to be in breach of the Code, that the Emergency procedure is being used and direct it to suspend the service immediately,
(ii) Direct any relevant Network operator or Level 1 provider to retain any payments outstanding in respect of the service under investigation,
(iii) Direct any relevant Network operator or Level 1 provider to bar access to the relevant service or numbers immediately if the party under investigation cannot be contacted or does not immediately suspend the service,
(iv) Publish its use of the Emergency procedure in such manner as it sees fit;
(d) Once the service has been suspended, PhonepayPlus will provide the relevant party with all necessary information about the alleged breaches of the Code. This will include details of the service and/or promotional material and will refer to the relevant sections of the Code;
(e) The relevant party will then have five working days in which to respond and provide any information requested. In exceptional circumstances, PhonepayPlus may set a shorter time limit;
(f) All relevant information, including any response from the party under investigation, will be placed before a Tribunal as soon as is reasonably practicable after the relevant party has responded, or the deadline for response has passed;
(g) The relevant party will be informed by PhonepayPlus of the date of the Tribunal consideration and entitled to make informal representations to it on that date in person in order to clarify any matter."
"Review of Emergency procedure
(a) Within two working days following the making of a direction under paragraph 4.5.1(c), or at any time prior to adjudication in the event that new information comes to light suggesting that the use of the Emergency procedure is not appropriate, the relevant party may apply to PhonepayPlus for an urgent review of the use of the Emergency procedure in the particular case.
(b) The application for review must be made in writing, must include any supporting evidence and must set out:
(i) the grounds on which the relevant party considers that the Emergency procedure should not have been used; and/or
(ii) the grounds on which the relevant party considers that access to the service or numbers should no longer be prevented.
(c) Subject to any requirement for further information, a Tribunal will consider the matter within two working days of receipt of an application for review and will decide, through whatever process it decides, whether the prevention of access to the services or numbers should continue pending completion of the normal Emergency procedure process, or whether access should be permitted to some or all of the services or numbers concerned, and if so upon what, if any, conditions. The Tribunal may also decide whether the Emergency procedure should be changed to a Track 2 procedure and/or whether PhonepayPlus should direct any relevant Network operator, Level 1 provider or Level 2 provider to cease retaining any payments outstanding in respect of the service under investigation."
"5.2.1 Some premium rate services may also be 'information society services' … Information society services are required to be regulated in accordance with Directive 2000/31/EC on Electronic Commerce ('the E-Commerce Directive'). The Code will apply to such services when the Level 1 or Level 2 provider responsible for the provision of those services under the Code is:
(a) established in the United Kingdom; or
(b) established in another EEA member state, but only where:
(i) the services are being accessed or may be accessed from within the United Kingdom, and
(ii) the conditions set out in Article 3.4 (read, as appropriate, in accordance with Article 3.5) of the E-Commerce Directive are satisfied."
The Factual Background
"In relation to the Level 2 provider called Ordanduu GmbH, PhonepayPlus has received 164 complaints in relation to the above, and other quiz competition services, between June 2012 and June 2013. The complainants have reported the following:
- Messages received were unsolicited;
- They were misled into entering the service and
- They were unaware of any costs.
These complaints had formed a preliminary investigation that was referred to DCMS [Department for Culture, Media and Sport] to gain authorisation from the EU member state (Germany) so that PhonepayPlus could proceed with a regular Track 2 investigation. This was sent to them in October 2012 and PhonepayPlus has yet to receive confirmation we can proceed with the investigation. The service described above in this memorandum was discovered and monitored on 12 June 2013, and now prompts the Executive to seek authorisation to adjudicate against Ordanduu GmbH using the Emergency procedure. The subject of the Emergency procedure case against Ordanduu GmbH would therefore encompass both the earlier service that was referred initially to the DCMS in October 2012 (and has to date generated 164 complaints), and the more recent service that has been discovered by internal monitoring by the RMIE [emphasis added]. For the avoidance of doubt, this more recent second service has not generated complaints, but this is likely to [be] due to its use of Payforit as a payment platform. Payforit codes differ significantly from PRS landlines and shortcodes, as they currently cannot be searched using our number checker function.
In relation to the Optimus service, PhonepayPlus has no complaints logged; however as with the more recent service operated by Ordanduu (above) we believe this may be due to the service being Payforit and not utilising a shortcode which the earlier Ordanduu service did. Due to the misleading nature of entering the service, the Executive considers the service to be serious enough to merit an EP."
"The Executive concerns are:
2.3.2 (Misleading)
The Executive asserts that users are misled into entering into a premium rate service because affiliate marketers introduce malware to the consumer's computer device which blocks their internet browser, and falsely informs them that the block is as a result of their attempt to download illegal material. Consumers are then falsely informed that in order to unblock their browser, they have to complete a survey which then enters them into a subscription service. After completing the survey, the browser remains blocked and the only option for consumers to regain full use of their computer is to visit a pc technician.
2.5.5
The Executive asserts that (i) the above 'scareware' tactic, whereby consumers are informed that their browser has been locked as a result of attempts to download pirated material, and (ii) the actual blocking of pc internet browsers, are likely to induce an unreasonable sense of 'fear', anxiety, distress, or offence. [Emphasis added by the Executive to highlight the Executive's view that the service is most likely to induce an unreasonable sense of anxiety or distress]
Recommendation
The Executive recommends that, as a result of the above concerns, that these investigations continue under the Emergency procedure and seeks your authorisation to do so."
"The Executive notes that the service was promoted by the affiliate marketer through a malware device which informed consumers that their browser had been blocked as a result of attempts to download pirated material and therefore asserts that the service was promoted in an inappropriate way."
"could finally manage to track down and receive approval to name the person who's receiving the payments for traffic coming from the sub-publisher http://www.wifihackpassword.com/. Please find eGENTIC's email attached. Please note, that the partners did only name him as the responsible person for the page and former domain holder – there's of course no proof he implemented or programmed the malware Trojan himself.
To prevent any further harm, the publisher will be banned from all future collaborations with eGENTIC or any of their contracted partners in writing. Although eGENTIC has no contractual relationship to him in person, they will make their legal department contact him proactively. The affected partners or their sub-partners, in case having a contractual relationship to this person, have been called upon taking legal actions against him.
In the meantime, we managed to delete all affected users from our services…"
"Following the instigation of the Emergency procedure [Ordanduu GmbH/Optimus GmbH] requested a review of the use of the procedure in accordance with paragraph 4.5.3(b)(ii) of the Code. The Tribunal considered [Ordanduu GmbH's/Optimus GmbH's] written and oral submissions in relation to the grounds on which it asserted that access to the service or numbers should no longer be prevented. The Tribunal was not satisfied that there was sufficient evidence to conclude there was no potential for future (or on-going) consumer harm and decided that the prevention of access to the service and numbers should continue pending completion of the normal Emergency procedure process."
"1. The three potential breaches of the Code highlighted in the Preliminary Investigation were each a product of the unauthorised and possibly fraudulent activities of an Affiliate marketer.
2. In response our client has agreed to suspend all Affiliate marketing (please see the precise detail of the steps our client has taken below).
3. Therefore, with links to the Affiliates severed, there is plainly no possibility for 'future (or ongoing) consumer harm'."
"Our client has informed the Tribunal that all such Affiliate activity has ceased… However, to date we understand that our client has not provided actual evidence of the cessation of such affiliate activity. We now provide this, in two forms:
1. The Letter to eGentic, our client's exclusive marketing partner, responsible for engaging the Affiliates. The letter clearly confirms that all Affiliate activity has ceased, and further is countersigned by eGentic.
2. Extracts from our client's database which clearly demonstrates that the Affiliate activity has ceased not only in theory (as evidenced by the above letter in point 1 above) but also in practice."
(1) In relation to Rule 2.3.1:
"The Tribunal considered all the evidence and submissions before it. The Tribunal noted that, during informal representations, the Level 2 provider had stated, 'We are not arguing under the Code that we are not responsible, we accept that'. In addition, the Level 2 provider accepted that the affiliate marketing malware promotions were illegal and in breach of the Code. As set out in the 'Preliminary issues' section, the Tribunal commented that Level 2 providers are responsible for the operation of their services, which includes the promotion of a service. Therefore, where a Level 2 provider chooses to engage in affiliate marketing, it accepts the risk that any affiliate marketing outside its direct control may lead to non-compliance for which it is responsible. Consequently, and for the reasons given by the Executive, the Tribunal concluded that consumers had not been treated fairly and equitably as a result of the malware affiliate marketing promotion in breach of Rule 2.3.1 of the Code. …
(2) In relation to Rule 2.3.2, the Tribunal gave the same reasons for its decision, and added:
"…Consequently, and for the first reason given by the Executive, the Tribunal concluded that consumers were likely to have been misled as a result of a number of misleading statements contained within the affiliate marketing promotions for the Service, into downloading malware and into believing that entering the Service would 'unblock' their internet browsers. The Tribunal concluded that the Level 2 provider was in breach of Rule 2.3.2 of the Code…"
In relation to the 164 earlier complaints, the tribunal continued:
"The Tribunal considered the submissions of the Level 2 provider in relation to the Executives Reason 2 (other forms of misleading affiliate marketing and complaints) and determined that the matter should be adjourned. This was on the grounds that there appeared to have been a lack of communication from the Executive that resulted in the Level 2 provider mistakenly believing that the complaints had been closed. The Tribunal commented that as the alleged breach in relation to the complaints had not yet been determined it had paid no regard to them."
(3) In relation to Rule 2.5.5, again the Tribunal gave the same reasons for its decision, as in relation to Rule 2.3.1, and added:
"Consequently, and for the reasons given by the Executive, the Tribunal concluded that consumers were likely to have been induced into an unreasonable sense of anxiety and distress in breach of Rule 2.5.5 of the Code…"
"In determining the final overall assessment for the case, the Tribunal took into account the following aggravating factors:
- The Level 2 provider failed to follow Guidance on Promotions and promotional material and Competitions and other games with prizes.
- There have been a significant number (approximately 11) of prior adjudications concerning affiliate marketing.
- The Level 2 provider benefited and/or would have potentially benefited from fraudulent marketing.
The Level 2 provider had no relevant breach history.
In determining the final overall assessment for the case, the Tribunal took into account the following mitigating factors:
- The Level 2 provider stated that it had the following measures in place to identify and mitigate against the risks associated with affiliate marketing:
- Contracts with the marketing partner with which it has a direct relationship. The contract contains a number of restrictions including penalty clauses for non-compliant behaviour.
- Addendums to the contract with its marketing partner on an ongoing basis in light of Tribunal decisions.
- Pre-approval of all marketing flows.
- Some proactive monitoring conducted by eGentic employees… Monitoring was conducted on an ongoing basis …
- 24hr fraud detection alert system.
- The Level 2 provider engaged with PhonepayPlus by proactively arranging meetings with PhonepayPlus and attending events.
- Blocking and blacklisting of affiliates marketers and/or publishers who engaged in non-compliant behaviour.
The Tribunal noted the measures taken by the Level 2 provider to control and monitor the risks posed by the use of affiliate marketing but commented that more could still be done to seek out rogue sites in a pro-active manner…
…
… Having taken into account the aggravating and mitigating factors, the Tribunal concluded that the seriousness of the case should be regarded overall as very serious."
"noted that the circumstances of the case were unusual as it was the first time that ransomware had been detected to have been used in the promotion of premium rate services. It also noted that there were no complaints from consumers. Having regard to all the circumstances of the case, the Tribunal decided to impose the following sanctions:
- a formal reprimand;
- a warning that if the Level 2 provider fails to ensure that it has sufficient measures in place to prevent actual or potential consumer harm being caused by affiliate marketing in future it should expect to receive a significant penalty for any similar breach;
- a fine of £25,000; and
- a requirement that the Level 2 provider must refund all consumers who claim a refund, for the full amount spent by them on the Service, within 28 days of their claim, save where there is good cause to believe that such claims are not valid, and provide evidence to PhonepayPlus that such refunds have been made."
Discussion
Article 3 of the Directive
Unfair process
Proportionality
"ask first whether the measure which is being challenged is suitable to attaining the identified ends (the test of suitability). Suitability here includes the notion of 'rational connection' between the means and ends. The next step asks whether the measure is necessary and whether a less restrictive or onerous method could have been adopted (the test of necessity, requiring minimum impairment of the right or interest in question). If the measure passes both tests the court may then go on to ask whether it attains a fair balance of means and ends. It is important to note here that the burden of justification in such cases falls on the public authority which has apparently infringed the rights of the claimant or offended a norm of European Union law." (Para 11-078).
Views of the European Commission
"Based on Sophie's input we can confirm that the conditions for invoking Article 3(5) ECD have been fulfilled and that the described measures taken (suspension concerning only services connected to the potential threat without restricting the operation of other services until sufficient evidence has been provided that the potential threat has been removed) appear to fulfil the requirements of Article 3(4)(a) ECD."
"PhonepayPlus concluded that pursuant to Article 3(4) of the E-Commerce Directive urgent action had to be taken against the provider to stop serious consumer harm occurring as identified below:
(1) Monitoring conducted by PhonepayPlus showed that the Provider's service was promoted by an affiliate marketer ('affiliate') who appeared to use a form of malware to lock consumers' internet browsers and, under the pretext of unlocking their browsers, force them to interact with online offers which took them to the landing pages of the provider's 'quiz competition' subscription services.
(2) PhonepayPlus has received 164 complaints from members of the public who reported that they (i) had been misled into entering into the service(s), (ii) were confused as to why the premium rate charges appeared on their mobile phone bill, and (iii) had not seen any pricing information."
"The conditions for invoking Article 3(5) could have been fulfilled in view of the perceived risk for consumers particularly regarding the used malware identified via monitoring on 12 June 2013. However, it appears that the 164 complaints received from members of the public over a longer duration (since June 2012) refer at least partially also to non-malware related affiliate marketing promotions already partially covered by an investigation carried out in 2012. For these complaints the urgency procedure does not seem to be justified.
The sanctions imposed by a PhonepayPlus Tribunal on 25 July 2013 appear to have been proportionate. However the concerned companies have been prevented from providing any services from 24 June to 15 July 2013 and service restrictions remained in place until mid-August 2013 despite the fact that the used malware threat allegedly had already been removed by 21 June 2013. It is unclear whether these measures under the given circumstances have been proportionate.
In order to finalise the assessment it would be useful to obtain the report from the investigation carried out in 2012 and some additional information on when the 164 complaints have been received and whether they concerned malware related and/or non-malware related affiliate marketing."
"The complaints
PhonepayPlus fully accepts that the complaints were a subsidiary matter and did not require urgent action. The Emergency procedure (EP) was used only in relation to our concerns regarding the discovery of the use of content locking malware (the malware). The complaints were only added in order to provide the full background to the investigation as they concerned the same service.
…
We note the Commission's request for further information relating to the complaints. As it appears to us that the complaints are not relevant to the urgent action that was taken, we have not provided the complaint data with this e-mail. However, if the Commission requires the complaint data after consideration of this e-mail we are happy to provide it.
Restrictions on the service
…
1. Restrictions between 24 June and 15 July
As you are aware, three members of the Code Compliance Panel independently agreed that the use of the EP was appropriate on Saturday 22 June. This was communicated to Ordanduu and Opitmus on Monday 24 June and the respective services were suspended on this date. The suspension only applied to the services connected to the malware and there were no restrictions on Ordanduu's and Optimus' ability to operate other services.
…
2. Restrictions between 15 July and publication of the decisions
The only restrictions in place between 15 July and publication of the Tribunal's decisions on 22 August related to the use of affiliate marketing to promote the specific services subject to the EP. For clarity, there were no restrictions on the operation of any of Ordanduu and/or Optimus' services or their use of non-affiliate marketing promotions."
Conclusion
Relief
"It is clear from the case law of the court … that three conditions must be satisfied for a member state to be required to make reparation for loss and damage caused to individuals as a result of breaches of Community law for which the State can be held responsible. (i) The rule of law infringed must have been intended to confer rights on individuals; (ii) the breach must be sufficiently serious; and (iii) there must be a direct causal link between the breach of the obligation resting on the state and the loss or damage sustained by the injured parties."
"14. … potential factors [are]: (1) the importance of the principle which has been breached; (2) the clarity and precision of the rule breached; (3) the degree of excusability of an error of law; (4) the existence of any relevant judgment on the point; (5) whether the infringer was acting intentionally or involuntarily or whether there was a deliberate intention to infringe as opposed to an inadvertent breach; (6) the behaviour of the infringer after it has become evident that an infringement has occurred; (7) the persons affected by the breach or whether there has been a complete failure to take account of the specific situation of a defined economic group; (8) the position taken by one of the Community institutions in the matter."