The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

Use of Pegasus software can amount to MPI and fall outside state immunity

29 September 2022

In Al-Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB), Julian Knowles J dealt with KSA’s application for strike out/summary judgment on the basis of state immunity of claims brought in relation to the use of Pegasus software to attack the Claimant’s iPhones. The claim in relation to Pegasus was brought in MPI, harassment and trespass to goods, with the Claimant alleging psychiatric injury on discovery of KSA’s hacking attempts. The Claimant said that the exception to state immunity in s.5 of the State Immunity Act 1978 applied, in that it was a claim for personal injury/damage to or loss of tangible property caused by acts or omissions in the UK.

Julian Knowles J held that s.5 covered all acts or omissions, including acts in the exercise of sovereign authority. He held that so long as some substantial and effective act causative of the required damage has taken place in the UK, the test is met, even if other similar acts have taken place elsewhere. He held that, on the balance of probabilities, KSA was responsible for Pegasus infection of the Claimant’s phones. As a result, the claim was not barred by state immunity. KSA’s application was dismissed and the claim will go forward to trial.

This case illustrates some of the creative ways in which the information-based torts can be relied upon in an ever-developing technological context. It is important to note that the Claimant had to deploy extensive expert evidence in cybersecurity to show KSA’s likely responsibility: a plea of state immunity is not an easy hurdle to surmount.

Further reading:

Al Masarir v Kingdom of Saudi Arabia [2022] EWHC 2199 (QB)

The Data Brief

A monthly data protection bulletin from the barristers at 5 Essex Chambers

The Data Brief is edited by Francesca Whitelaw KC, Aaron Moss and John Goss, barristers at 5 Essex Chambers, with contributions from the whole information law, data protection and AI Team.

Visit the Information Law, Data Protection and AI area

Search The Data Brief

Portfolio Builder

Select the practice areas that you would like to download or add to the portfolio

Download    Add to portfolio   
Title Type CV Email

Remove All


Click here to share this shortlist.
(It will expire after 30 days.)