Click here to link to the original article in the August/September issue
For those unfamiliar with the facts of the case, Totalise plc (the Claimant) is an Internet service provider. Motley Fool Limited (MFL) and Interactive Investor Limited (IIL), who were the joint Defendants both offered bulletin boards on their Web sites upon which members of the public could post comments. One of MFL’s subscribers posted a number of messages on its bulletin board, using the nom-de-web ‘Zeddust’, which Totalise considered were highly defamatory of its organisation and its management team. Totalise complained and successfully persuaded MFL to remove the postings and to revoke Zeddust’s right of access to the bulletin boards. However, when Totalise asked MFL to disclose Zeddust’s true identity so that it could bring proceedings for defamation against him, MFL refused, stating that this would be contrary to MFL’s terms and conditions and privacy policy. MFL also relied on the DPA.
Zeddust moved his activities to IIL’s bulletin board, and posted further similar comments there about Totalise. After receiving a complaint from Totalise, IIL removed the comments, denied access to Zeddust but refused to disclose Zeddust’s true identity, also citing its own terms and conditions and the DPA.
Totalise was faced with a dilemma. Unless it could stop the postings, Zeddust’s campaign was likely to continue. However effective action depended upon discovering Zeddust’s identity.
The Original Decision
Totalise issued a claim against MFL and IIL for disclosure of the real name and address of Zeddust (and other documents relating to Zeddust’s identity), basing the claim on the principle established by the House of Lords in Norwich Pharmacal Co v Customs & Excise [1994] 1 AC 133. At the original hearing the judge made the disclosure order under this principle and, when considering costs, said:
“I accept that the defendants had to carry out [a] balancing exercise, but in my judgment there was only one answer to that balancing exercise, namely that they should have complied with the requests made by the claimant. In those circumstances, I order the defendants to pay the claimant’s costs of this application/action”.
Totalise’s costs were assessed at £4,817.
The Implications of the Original Decision
As explained in the authors’ original article, the usual approach to costs in a Norwich Pharmacal application is set out in the notes to CPR 31.181 in the White Book, which states: “the claimant seeking the name of the wrong doers will have to pay a blameless defendant’s expenses”. In ordering the defendants to pay Totalise’s costs at the original hearing, the inference was that the defendants were to blame. Indeed, the judge said:
“there is considerable force in [the] argument that those who operate websites containing discussion boards do so at their own risk . [it had been] perfectly plain from the outset . that the defendants should have complied with the requests made by the claimant [without the need for court action]”.
IIL, however, did not think that it had been ‘perfectly plain’ and also questioned whether it was right to treat a Norwich Pharmacal application as an adversarial type application, where the general rule is that the unsuccessful party is effectively blamed by being ordered to pay the costs of the successful party. It therefore appealed against the costs order (although it did not seek to reverse the order for disclosure).
The Appeal Arguments
IIL’s arguments can be summarised as follows:
- The trial judge had not given any weight to the fact that IIL was contractually obliged both under its terms and conditions and privacy policy not to reveal the identity of its users, giving rise to a duty of confidence to Zeddust.
- Whilst the DPA potentially permits disclosure in these circumstances,2 IIL was not in a position to judge whether Zeddust had a legitimate interest which should be protected – in particular the right to freedom of expression.
- The trial judge should have considered the comments of Lords Reid and Cross in the Norwich Pharmacal case in relation to costs orders in this type of application. Lord Reid said:
“If the respondents have any doubts in any . case about the propriety of making disclosures they are well entitled to require the matter to be submitted to court at the expense of the person seeking the disclosure”.
This was supported by Lord Cross who said:
“in any case in which there is at least doubt as to whether disclosure should be made the person to whom the request was made would be fully justified in saying that he would only make it under an order of the court.. The full costs of the respondent of the application and any expense incurred in providing the information would have to be borne by the applicant”.
IIL also argued that these principles were more akin to the provisions in CPR Part 48.1 concerning pre-action disclosure and not CPR Part 44.3 concerning costs in adversarial proceedings as had been considered by the trial judge.
- IIL had not opposed the granting of the order, but had merely taken a neutral stance, leaving it to the judge to weigh up the conflicting issues.
- IIL was caught in a conflict not of its own making. Had it honoured the request without a court order, IIL would have been exposed to claims for breach of contract and breach of confidence in addition to potential liability under the DPA. Furthermore, as Totalise would expect to get its costs from Zeddust in the anticipated defamation action, a costs order against IIL served to enable Zeddust to avoid having to pay the costs that resulted from his misconduct.
The Appeal Court’s Decision
The Court of Appeal was convinced by IIL’s submissions. It held that not only should IIL not have had to pay Totalise’s costs but it should have recovered its own costs. The Court gave the following three reasons.
First, The Court of Appeal re-affirmed the principle that the burden is on the Norwich Pharmacal applicant to satisfy the court that a disclosure order should be made, not on the defendant to take a view of the applicant’s position or the rights of the wrongdoer, as that view could be wrong. The Court referred to para 6(1) Sch 2 to the DPA, which permits disclosure unless the processing is The Court went on to say that there are many circumstances in which it may be legitimate to protect a person’s identity and that, since the Human Rights Act 1998 was now in force, the courts must be careful not to make an order that unjustifiably invades an individual’s right to respect for his private life, especially when the individual is not before the court. In its decision, the Court of Appeal advocated that a Web site operator who receives a request for disclosure could, where appropriate, (a) tell its subscriber that it has received a request for disclosure, and (b) offer to pass on to the person making the request (and the court if required) any reason that that subscriber has for not having his information disclosed, as all of this would help the court to conduct the balancing exercise in compliance with other laws.
The Court of Appeal also considered that it was legitimate for a party such as IIL, which has a reasonable contractual obligation to maintain confidentiality, to refuse voluntarily to hand information over, as that would require consideration of both the contractual terms and conditions and the merits generally and instead to wait for a court order. The Court considered that the position might be different if the party from whom disclosure was sought was in some way implicated or involved in the wrongful act.
The Court of Appeal’s third reason was more complicated. Given that IIL was not itself implicated in Zeddust’s wrongful acts (the trial judge had determined that it was effectively ‘blameless’), the Court of Appeal agreed with IIL that Norwich Pharmacal proceedings are not ordinary adversarial proceedings where the general rule is that the unsuccessful party pays the successful party’s costs. The Court preferred IIL’s argument that such applications are akin to proceedings for pre-action disclosure where costs are governed by CPR Part 48.3 and that in a ‘normal’ application the applicant should be ordered to pay the costs of the party required to disclose, including the costs of making the disclosure. The Court explained ‘normal’ cases to be those where:
- the party required to make the disclosure has a genuine doubt that the person seeking the disclosure is entitled to it; or
- the party is under an appropriate legal obligation not to reveal the information, or the position is not clear, or the party has a reasonable doubt as to its obligations; or
- the party would be subject to proceedings if disclosure is voluntary; or
- the party would or might suffer damage by voluntarily giving the disclosure; or
- the disclosure would or might infringe the legitimate interests of another.
In this particular case, all of these criteria were satisfied, although their lordships pointed out that this might not be so in all cases and that the court should consider all the circumstances, recognising that some situations may require a different order.
Conclusions
Before the Court of Appeal’s decision, Web site operators and other similar organisations were placed in a position of considerable uncertainty. They had the choice of making potentially erroneous judgments as to whether to disclose information (with the possibility of claims for breach of contract and breach of confidence together with potential liability under the DPA) or to pay the Norwich Pharmacal applicant’s costs – effectively making disclosure on demand a real possibility. In this case it was clear that Zeddust had defamed Totalise. However, in other cases the position may not be so clear. The person requiring disclosure might not have an actionable case or might be using the original ruling as a means of conducting a fishing expedition.
Following the Court of Appeal decision, it is clear that, if a Web site operator receives a request to disclose information, it is, in ‘normal’ cases, entitled to decline to do so without an order of the Court and to recover both its costs of any application seeking disclosure and, if ordered to make disclosure, its costs of doing so. However, if the Web site operator is implicated in the misdeed giving rise to the request for disclosure, it runs the risk of being ordered to pay both its own costs and those of the Norwich Pharmacal applicant.
So, what can Web site operators do to minimise their risk potential? In the light of the Court of Appeal decision, organisations that are likely to face disclosure requests should review their privacy policies and terms and conditions to ensure that they can place themselves under a clear duty of confidence to their users.
Furthermore, whilst the DPA does not require disclosure in the type of situation arising in Totalise (rather it is permissive provided the disclosure is not in practical terms it will be sensible for the Web site operator to heed the advice of the Court of Appeal and to put its subscriber’s views before the Court in any application for disclosure. The Court indicated that in future cases it could require a Web site operator to do so before making an order. Pre-empting the Court’s request may be a prudent means of avoiding a wasted costs order.
©Addleshaw Booth & Co
Amanda Kearsley and Nick Rudgard are Solicitors in the Technology, Media and Intellectual Property Group in Addleshaw Booth & Co, and can be contacted at: amanda.kearsley@addleshaw booth.com and mailto: nick.rudgard@addleshawbooth.com
Endnotes
1. See paragraph 31.18.3 of the White Book.
2. Paragraph 6(1) of Schedule 2 to the DPA 1998 allows disclosure where “The processing is necessary for the purposes of the legitimate interests pursued by the data controller or by a third party or parties to whom the data are disclosed, except where the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms o
