On 21 November, in Rugby Football Union v Viagogo Ltd  UKSC 55, the UK Supreme Court upheld the Court of Appeals' order for the disclosure of the identities of individuals who had used an online ticketing website to sell and purchase international rugby tickets at inflated prices in breach of the Rugby Football Union’s (RFU) ticket terms and conditions.
The appellant, an online ticket-selling company called Viagogo, argued that complying with a Norwich Pharmacal Order (which requires the disclosure of documents relating to third parties) would involve a breach of Article 8 of the Charter of Fundamental Rights of the European Union, which grants the right to the protection of personal data. The lower courts had issued the order requiring Viagogo to disclose the documents to the RFU as the RFU had an arguable case of breach of contract and trespass, and had no alternative means to discover the identities of the individuals who used Viagogo to sell six-nations rugby match tickets.
In claiming that disclosure of the ticket sellers’ names and addresses would breach their data protection rights, Viagogo asked the Supreme Court to evaluate the impact on each of the individuals on a case-by-case basis against the value to the RFU of receiving their personal data, rather than any wider possible value, such as deterring others from selling or buying rugby tickets via similar websites.
The Supreme Court rejected Viagogo’s argument that the examination should be conducted narrowly, ruling that courts must also take into account the broader context. The court emphasised that an individual’s personal data can be disclosed where it is necessary and proportionate, and where an “intense focus” on the rights of individuals does not lead to the conclusion that the individuals whose data will be disclosed will have been “unfairly or oppressively treated” in all the circumstances after a careful weighing of all relevant factors. In upholding the disclosure order, the Supreme Court took into account the RFU's desire to prevent the future sale of tickets for international matches at inflated prices, and the fact that the order might deter individuals from breaching the RFU ticket terms.
The Supreme Court also stated that any disclosure of individuals' personal data under a Norwich Pharmacal order will always require consideration of how the individual will be affected and that “in some limited instances,” individuals’ data protection rights “may displace the interests” of the party seeking disclosure even where that party has no immediately feasible alternative means of obtaining the information.
The case demonstrates that disclosure of individuals’ personal data may be overridden when there are competing rights, and when given the wider content, the disclosure is proportionate.