Norwich Pharmacal order
Reasons for claimant's further application
Determination of claimant's further application
In the recent High Court case of Patel v Unite(1) the court granted an order for an independent IT expert to inspect the respondent's computer systems after the respondent failed to comply fully with a Norwich Pharmacal order.
The claimant was Mr Patel, a British Airways captain. The defendant was Unite, a trade union of which the largest branch is the British Airline Steward and Stewardesses Association (BASSA).
Patel claimed to have been the victim of a campaign of defamatory allegations and harassment by BASSA members on the BASSA internet discussion forum and elsewhere. This alleged campaign appeared to stem from Patel being identified as 'volunteer cabin crew' - one of a number of British Airways captains to undergo cabin crew training to provide cover during industrial action.
Patel's claim was based on seven separate discussion threads on the BASSA forum, appearing in early 2011, which (among other things) alleged that he was unsafe to fly with, was unfit to be a captain, was guilty of illegal and unsafe behaviour and was corrupt. It was impossible for Patel to identify who had posted these comments, as the forum user names concealed the users' true identity. Patel wanted to identify the individuals behind 42 separate user names.
The BASSA forum was operated by Unite, which took the forum offline some time after the posts in question were made. However, Unite refused to respond to Patel's request to identify the users in question. Therefore, Patel applied to the court for a Norwich Pharmacal order.
A Norwich Pharmacal order is an order for disclosure of certain documents or information. It is made against a party that has been involved in wrongdoing, intentionally or otherwise, and is unlikely to be a defendant in the proposed proceedings. It is commonly used pre-action by potential claimants, either to identify the proper defendant to an action or to obtain information to plead a claim.
Patel's application was successful and an order was made that Unite carry out a reasonable search to locate the information sought and to provide the identities, home addresses and internet protocol addresses of the individuals who had used the user names in question.
Unite claimed that following this order, it contacted System Serve Limited, which provided and had designed Unite's website, to see what information could be retrieved. The conclusion was that the information on the forum at the time of deletion could not be retrieved, because no back-up copy was taken before deletion. Unite claimed that only one back-up of the forum was available, from January 2011, before the comments in question were posted.
This was problematic for Patel for two reasons. First, information could not be provided for all of the 42 user names, but only for those user names in use before the comments were made. Second, forum members could - and apparently did - change and swap user names in order to conceal further their identities, so it was impossible to be sure that the person behind a user name at the time of the back-up was the person behind the user name when the comment was made. As such, Unite stated that it could not comply with the order.
Reasons for claimant's further application
Patel did not accept that the order could not be complied with. Unite had failed to provide the information requested or to explain what had happened to it. Patel therefore sought an order for an independent expert to:
- be given access to all available copies of the BASSA forum and associated databases; and
- be permitted to make an image of any existing or deleted information that the expert might consider necessary in order to prepare a report limited to the identification of the information sought.
In support of his application, Patel claimed that Unite had previously told him that the offending posts had been removed from view but preserved, and that Unite had previously made clear to him that it could identify the people involved and communicate with them.
Patel had also consulted his own technical expert, whose view was that, given the particular software used to run the forum, all back-ups of the forum would include database tables which would make it easy to identify the specific user responsible for a post. Indeed, Patel had been able to conduct part of the analysis required using hypertext markup language copies of the relevant pages from the BASSA forum. Moreover, the expert's view was that the relevant data would still exist on the server on which the forum was hosted, and that this data could be forensically recovered.
Unite claimed to have attempted to run the searches suggested by Patel and his expert, but claimed that it had been unsuccessful because it required the post identification tag, and the offending posts had been deleted. It therefore tried to search the BASSA database using text culled from the offending posts. It claimed that none of the relevant text had been located.
Although its text searches did not reveal the offending posts, Unite found material from other posts which had been on the BASSA forum. Thus, it appeared that the deletion of the forum had not simply (as is usual with data deletion) removed the location address of the data while leaving the data intact until overwritten by other data, but had removed the underlying data itself. As a result, Patel's solicitors asked Unite whether the information had been deleted and, if so, by whom, making the point that even if the information had been deleted, it should be recoverable from the server. Unite cited further technical reasons why it was unable to provide this information.
Determination of claimant's further application
The judge concluded that Unite's evidence of compliance with the Norwich Pharmacal order was in a very unsatisfactory state. The judge did not believe that it was the fault of the individuals who had been dealing with the matter for Unite, and that they "did not themselves understand the technicalities of the BASSA website". However, there was reason to believe that Patel had supplied Unite with information which might well enable the information sought to be provided, and that his information had not been properly followed up. What was to be done about this?
Does the court have power?
In the judge's view, the first question was whether he had the power to make the order sought by Patel, which would undoubtedly be intrusive. The judge observed that "no domestic authorities on the point have been brought to my attention, and it appears that no mention is made of such a step in CPR 31BPD, which governs electronic disclosure". However, the judge had been referred to a passage in a leading textbook on disclosure, which suggested that the court has such a power and will grant such an order where it can be shown to be necessary and proportionate.
The judge continued:
"In my judgment, it must be open to the court, where there is reason to believe that a previous order of the court has not been fully complied with for reasons of technical understanding, to make such further order as is necessary and proportionate to enable and assist the respondent to comply and to ensure that the earlier order is not frustrated by an innocent failure to understand the technical issues."
Impact of sensitive personal data
The second issue was that the order sought would, according to Unite, involve the sensitive personal data of its members. The judge accepted that union members would undoubtedly have rights to be protected under both the Data Protection Act 1998 and Article 8 of the European Convention on Human Rights, and that the definition of 'sensitive personal data' included information about trade union membership. However, the judge observed that the information involved was not of the most sensitive kind, such as information about religious beliefs, sexual life or medical matters. The question would be whether it was proportionate for the court to make an order requiring disclosure of the data in question.
The judge cited The Rugby Football Union v Viagogo,(2) where the Court of Appeal had to consider whether it was proportionate to make an order which would entail the disclosure of personal data. In that case, the court held that it would generally be proportionate to make an order revealing the identity of arguable wrongdoers. Disclosure of a limited amount of personal data was regarded as proportionate because there was no other way in which arguable wrongdoing could be exposed.
The judge also noted that the terms and conditions of the BASSA website warn members that BASSA reserves the right to disclose their identities and other information if requested by a third party, albeit subject to their rights of privacy and data protection.
The judge concluded that the intrusiveness of the order proposed, particularly as regards innocent members who had not posted the material involved in the complaint, could be significantly reduced by ordering that:
- the necessary work be carried out by an independent expert, appointed jointly by the parties; and
- the expert give suitable undertakings not to disclose to Patel or any other person any information obtained in the course of his or her examination of the BASSA database, except information which:
- identified those responsible for the posts complained of; or
- explained why they could not be identified (if this were the case).
On that basis, the order sought satisfied the test of proportionality and the need to respect, so far as possible, the privacy and data protection rights of BASSA members.
The judge ordered Unite's costs of compliance and the costs of instructing the expert to be borne by Patel (as would be usual for a Norwich Pharmacal order).
The particular circumstances in which the court will make this type of order appear to be as follows:
- There must be reason to believe that a Norwich Pharmacal order has not been fully complied with due to lack of technical understanding.
- Any further order made to address this must be necessary and proportionate to enable the respondent to comply.
- Where a further order would be intrusive and, particularly, where it would involve the personal data of innocent individuals, the court may mitigate that intrusiveness by requiring, for example, the appointment of a joint expert and the provision by the expert of appropriate undertakings.
It is interesting to consider whether the court's jurisdiction in this area is truly restricted, as the judgment suggests, to situations where there has been a lack of technical understanding by the respondent. In this case the judge was at pains not to suggest a lack of effort by the Unite representatives dealing with the matter; but what if the respondent simply does not make an effort to comply properly with a Norwich Pharmacal order, regardless of its technical expertise? It would be fair to assume that a similar order to that sought by Patel would be available by analogy (in addition to any other remedy that the applicant might have for breach of the original order).
The question also arises of whether the terms of the order could be stricter if there were a finding of dishonesty on the part of the respondent. There was no such finding in the present case - although a reader of this judgment may detect an occasional raised judicial eyebrow. If a judge made such a finding, an applicant in a future case might succeed in obtaining a stronger order, such as the appointment of its own expert, rather than a jointly instructed expert.
Claimants and potential claimants now have a potential additional tool in their toolbox when attempting to obtain information to put together their claims; whereas parties that are subject to a Norwich Pharmacal order will need to be on guard against this type of follow-up order if a court perceives that they have failed to comply fully with the initial order. Such parties may wish to consider appointing their own IT expert on a pre-emptive basis to ensure that their opponents cannot point to technical routes which have not been fully explored.
Given the increasing complexity of electronic disclosure issues, it is certain that this type of situation will arise more frequently. Thus, the claimant in this case may, in time, have the dubious honour of seeing these orders referred to as 'Patel orders'.
For further information on this topic please contact Benjamin Roe at RPC by telephone (+44 20 3060 6000) or email ([email protected]).