In Al-Masarir v Kingdom of Saudi Arabia  EWHC 2199 (QB), Julian Knowles J dealt with KSA’s application for strike out/summary judgment on the basis of state immunity of claims brought in relation to the use of Pegasus software to attack the Claimant’s iPhones. The claim in relation to Pegasus was brought in MPI, harassment and trespass to goods, with the Claimant alleging psychiatric injury on discovery of KSA’s hacking attempts. The Claimant said that the exception to state immunity in s.5 of the State Immunity Act 1978 applied, in that it was a claim for personal injury/damage to or loss of tangible property caused by acts or omissions in the UK.
Julian Knowles J held that s.5 covered all acts or omissions, including acts in the exercise of sovereign authority. He held that so long as some substantial and effective act causative of the required damage has taken place in the UK, the test is met, even if other similar acts have taken place elsewhere. He held that, on the balance of probabilities, KSA was responsible for Pegasus infection of the Claimant’s phones. As a result, the claim was not barred by state immunity. KSA’s application was dismissed and the claim will go forward to trial.
This case illustrates some of the creative ways in which the information-based torts can be relied upon in an ever-developing technological context. It is important to note that the Claimant had to deploy extensive expert evidence in cybersecurity to show KSA’s likely responsibility: a plea of state immunity is not an easy hurdle to surmount.
A monthly data protection bulletin from the barristers at 5 Essex Chambers