Skip to Main Content
The Liability of Internet Intermediaries The Liability of Internet Intermediaries

Contents

The Liability of Internet Intermediaries The Liability of Internet Intermediaries
1

The scope of equitable disclosure 4.03

1.1

Is disclosure a remedy? 4.06

1.2

Historical development of the equitable jurisdiction 4.15

1.3

The nature of liability 4.21

1.4

Rationale 4.27

1.5

The modern requirements restated 4.38

1.6

Compatibility with European law 4.53

2

Equitable disclosure by internet intermediaries 4.65

2.1

Platforms 4.65

2.2

Hosts 4.93

2.3

ISPs 4.98

2.4

Search engines 4.115

2.5

Social networks 4.120

3

Assessing the proportionality of disclosure 4.123

3.1

Making a request for disclosure 4.126

3.2

Responding to a request for disclosure 4.130

3.3

Proportionality 4.137

3.4

Safeguards 4.169

4

Statutory disclosure remedies 4.186

4.1

Pre-action disclosure 4.187

4.2

Non-party disclosure 4.191

4.01 Internet intermediaries frequently acquire information about tortious activity which is relevant to a claim against a third party. Such information can be relevant in two ways: first, it may reveal the identity of an anonymous user who is alleged to have committed a wrong; and second, it may supply evidence of the acts carried out by that user and the rights which the claimant says have been infringed. Obtaining access to this information is often essential for a claim to proceed, since without it the true tortfeasor may remain unknown. However, disclosure is unlike many other remedies because it is available without proof of wrongdoing by the disclosing party.

4.02 This chapter considers the circumstances in which internet intermediaries may be compelled to disclose information within their control for the purpose of taking action against an anonymous or pseudonymous wrongdoer. Faced with growing numbers of requests for information,1 these intermediaries are becoming gatekeepers not just of content but also of litigation. They control the missing pieces of the evidentiary jigsaw which claimants must assemble to bring a successful claim. These requests fall to be determined according to well-established equitable principles, subject to some recent conceptual restructuring to reflect concepts of proportionality and fundamental rights.

4.03  The modern formulation. That the tortious activities of third parties can create duties to disclose their identities was accepted in Norwich Pharmacal Co v Customs and Excise Commissioners.2 In this case, the defendant was a government department charged with administering taxes on goods imported into the United Kingdom. Pursuant to its statutory duties, the Customs kept records of each consignment’s consignor, consignee, and description. The patentees became aware that third parties were importing their patented compound without permission but did not know who. They therefore sought disclosure of the names from the Customs. The House of Lords unanimously granted the application. Lord Reid identified in the authorities

a very reasonable principle that if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers.3

4.04 Lord Kilbrandon stated the duty in relational, rather than causal terms, requiring the respondent to ‘stand in some relation to’ the owner of the goods,4 which reflects the American formulation.5 The Customs’ physical control over the goods, knowledge of their nature, and statutory functions together established a relationship sufficient to impose an equitable duty of disclosure. Lord Morris emphasised that there must be a reasonably arguable case of primary wrongdoing, and that here any third parties identified in consignment documents could ‘reasonably be assumed to be wrongdoers’.6

4.05  Nature of the duty. In the Court of Appeal, the obligation to disclose was described by Buckley LJ as an ‘equitable duty’, which comprised two related elements: not to part with infringing goods and to give all necessary information to the claimant.7 The remedy for breach of either limb was an injunction, but no action for damages would lie against the defendant. In subsequent proceedings, the primary claim was tested and proved against the identified consignor, who was held to be a joint tortfeasor with the consignees.8

4.06  Classifying equitable disclosure. Norwich Pharmacal disclosure has both procedural and substantive aspects: it is procedural in the sense that enforcement is by mandatory injunctions which enforce duties to the Court rather than duties to remedy wrongdoing. However, it is also properly described as a final ‘remedy’9—a description which reflects four substantive attributes.

4.07 First, applications for disclosure involve a preliminary consideration of the merits of an allegation against the third party wrongdoer (‘the primary claim’).

4.08 Second, an order for disclosure is final—indeed, it is often the only relief that is sought against the defendant—and compliance is mandatory on penalty of contempt.

4.09 Third, giving disclosure may involve considerable expense for the respondent. For example, it may be necessary to correlate multiple sources of data, to verify that the disclosed data do not reveal the personal information of innocent third parties, and (in the case of detained physical goods) to incur storage costs.

4.10 Finally, assessing a claim for disclosure is essentially a process of balancing the rights of claimants, internet users, and service providers. Claimants desire access to justice and meaningful remedies against those who would cause them loss online; internet users seek the freedom to receive and express information without compromising their privacy. Service providers are caught in the middle: wishing neither to upset their customers nor incur primary liability to claimants or for contempt of court, but seeking to minimise their operating costs and carry on their business without excessive interference.

4.11  Other descriptions. Cases variously describe disclosure as ‘an equitable duty’10 not to facilitate infringement, a ‘mere quia timet action’ to prevent the primary wrong,11 ‘a duty to assist the person injured...by giving him any information which he is able to give’,12 and even ‘a stand-alone remedy’,13 ‘substantive relief’,14 and a ‘substantive remedy of discovery’.15

4.12 In British Steel Corporation v Granada Television Ltd, Megarry VC described the equitable jurisdiction as a separate cause of action whose sole relief was disclosure, which is ‘just as much an action for equitable relief as an action for specific performance or an injunction.’16 This duty bears some similarities to the various species of secondary liability examined elsewhere in this work—because it derives from an independently caused primary wrong—but it is conceptually and historically distinct.

4.13  Competing interests. The remedy of disclosure weighs the competing interests of users, claimants, and internet intermediaries, and places both lower and upper limits on the extent of their cooperation. These boundaries are important because disclosure regulates and potentially destroys anonymity. It does so by allowing claimants to aggregate fragments of an internet user’s identity, piercing the curtain drawn between users on a service provider’s network and other internet users.

4.14 Courts are natural gatekeepers of this process. It is proper that requests for identity information be rigorously examined. The primary claim must have realistic prospects of success. Requests which are unnecessary, disproportionately costly, or likely to harm innocent users will be refused. Equally, in appropriate cases, disclosure upholds the rule of law by permitting claimants to complete their causes of action and so vindicate their rights, thereby deterring tortious conduct and holding third parties accountable for wrongdoing.

4.15  Origins of disclosure. The disclosure principle has its basis in the equitable protective jurisdiction, pursuant to which a person could bring an action for a bill of discovery against a non-party, provided that person was not a ‘mere witness’.17 Until Norwich Pharmacal, the general rule was that no action for discovery lay against an innocent party unless an independent cause of action could be maintained against that party.18 This rule is best understood as a procedural anachronism deriving from the separate administration of equity and common law;19 its main purpose20 was to prevent disclosure from being ordered against a person who would ultimately be compellable to give evidence as a witness. The mere witness rule simply delayed rather than excluded disclosure.21

4.16  Development of equitable disclosure. By the late nineteenth century, offline intermediaries were routinely ordered to give over what information they knew unless ‘absolute necessity’ could be shown.22 Almost any involvement in a wrong was sufficient to evade the mere witness rule, leading Hollander to conclude that it ‘has, in essence, disappeared’.23 Many were claims against the nineteenth-century equivalents of ISPs—wharfingers, carriers, or forwarding agents who transported or stored infringing goods on behalf of the primary tortfeasor and thereby ‘facilitated’ the wrongdoing.24

4.17 In Orr v Diaper,25 for example, the defendants were shippers who had been transporting cotton thread in coloured papers which imitated the claimants’ distinctive packaging. Hall VC ordered disclosure. Diaper’s liability was limited: because he was not a tortfeasor at law, he could be enjoined from passing on counterfeit goods that were within his possession and control under the protective jurisdiction, but not liable to pay damages to the claimant.

4.18 Other examples abound of carriers being obliged to furnish information once mixed up in a wrongful transaction. In Upmann v Elkan, a dock company came under a duty ‘absolute and without qualification’ to hold counterfeit goods and furnish upon the trade mark owner all relevant facts, once notified.26 The reasoning was prescient: like many modern cases, it requires purveyors of new technologies (in this case for transmission of goods) to police wrongdoing made possible by their services.

4.19  Inapplicability of ‘mere witness’ rule. What the Court recognised in Norwich Pharmacal was that the mere witness rule was never intended to apply where there was no prospect of a trial without disclosure. Although Lord Kilbrandon criticised the rule as ‘settled, rightly or wrongly’, it had no application where:

the whole basis of the application is that, until the defendant has disclosed what he knows, there can be no litigation in which he could give evidence.27

4.20 Thus, a person who facilitates the commission of the primary wrong and holds the crucial information is not a mere bystander or witness to the wrong. His involvement goes beyond spectatorship and places him in an ‘intermediate position’ between witness and tortfeasor.28 It was this facilitating conduct—the getting ‘mixed up in the tortious acts of others’—which Lord Reid sensibly said excludes cases like Norwich Pharmacal from the operation of the mere witness rule, to the extent it survives.

4.21  Absence of personal liability. Before considering the disclosure duties of internet intermediaries, it is necessary to understand that liability to disclose under the terms of a Norwich Pharmacal order is not the same as liability to pay damages or another monetary remedy. As Lord Woolf CJ pointed out in Ashworth Hospital Authority v MGN Ltd,29 the jurisdiction applies to a person who, ‘without incurring any personal liability, becomes involved in a wrongful act of another’. The order is thus not a remedy for wrongdoing by the disclosing party, but an exercise of the equitable protective jurisdiction by which claimants are guaranteed access to justice.

4.22  Content of the equitable duties. Although it is common to speak of a ‘duty’ of disclosure, it is not a unitary obligation but comprises two distinct but related duties: one voluntarily assumed, the other imposed. The originating equitable duty arises when a defendant first becomes mixed up in wrongdoing, to disclose what he knows about it. It is ancillary to the claimant’s rights against the primary wrongdoer. If the defendant’s involvement extends to the possession of infringing goods, a duty not to part with those goods may also arise. The defendant may of course give disclosure voluntarily, or he can be ordered to do so by injunction. At this point a second set of obligations arise, which compel the defendant to act or face criminal liability as a contemnor, but do not provide any substitutive remedy for the defendant’s prior failure to give disclosure. These obligations are owed to the Court—to comply with the injunction’s terms—rather than to the claimant. Consistent with this view, disclosure remedies are not products of a mechanistic formula for relief but instead depend upon the exercise of judicial discretion.30

4.23  Mandatory injunctions to disclose. It follows from this that Norwich Pharmacal remedies do not themselves create liability to the claimant. Rather, such orders are properly understood as mandatory injunctions which simply crystallise the equitable obligation of disclosure into a new duty to the Court. This duty is superimposed upon the existing framework of relationships between the respondent and third parties. For example, such an order (if made) overrides any existing duties of confidentiality owed by an intermediary to its customers, and obliges cooperative measures ‘which but for the order would be a gross breach of contract’.31 It is, in short, a supervening obligation imposed by the court whose object is the preservation of the applicant’s rights and thereby the proper administration of justice.

4.24 A disclosure order shares some features with a freezing order,32 which is routinely served on banks and other financial intermediaries, except that disclosure is mandatory (requiring positive acts of disclosure) rather than prohibitory (preventing acts dissipating assets), and is generally made against the intermediary directly (rather than against the debtor himself and then notified to the intermediary). For deposit-taking institutions, ‘receiving notice of such injunctions is, literally, an everyday event’.33 However, the injunction does not create any new duty to the claimant—only a duty owed to the court. As such, a freezing order is ‘enforceable only by the court’s power to punish those who break its orders’ and not in an action for negligence.34 It says to the defendant and any notified parties who fall within its terms: comply or face liability as a contemnor.

4.25 Subject to these differences, a Norwich Pharmacal order operates analogously. Lord Bingham expressly made the comparison in Barclays Bank, placing disclosure orders into the same category of non-consensual orders that do not create duties of care but simply give effect to existing equitable duties. In Ashworth, Lord Woolf CJ accepted a similar analogy.35 The liability that flows from breach of a Norwich Pharmacal order is therefore one arising under the court’s processes. This is unlike, for example, an injunction that requires the defendant to discontinue tortious activity, breach of which may sound not only in contempt but also in damages.

4.26  Consequences of a failure to disclose. Breach of a disclosure order by the addressee can lead to a finding of contempt. For example, an internet intermediary may delete the relevant data, deliberately assist another party to breach the order,36 or simply fail to comply within the stipulated time and thereby frustrate its purpose.37 Nevertheless, in all these cases, it appears that the claimant has no monetary remedy against the service provider.38

4.27 The primary purpose of disclosure is to enable the claimant to identify someone who has done him wrong. The court orders disclosure in circumstances where, without it, he would not know whom to sue. Relatively few commentators have considered the theoretical justifications for this jurisdiction, which broadly fall into three categories: (1) preserving claimants’ rights; (2) upholding the administration of justice; and (3) efficiency. Properly analysed, these justifications are universal and do not support treating equitable disclosure as an ‘exceptional’ remedy.

4.28 Without disclosure, ignorance of the wrongdoer’s identity would be a fatal roadblock on the claimant’s path to an effective remedy. Courts have long been mindful of the injustice that would result if claimants were left without recourse:

In this case the plaintiffs do not know, and cannot discover, who the persons are who have invaded their rights . . . Their proceedings have come to a deadlock, and it would be a denial of justice if means could not be found in this court to assist the plaintiffs.39

4.29  Preventing injustice. As Lord Morris commented in Norwich Pharmacal, without disclosure primary infringers could act with impunity.40 Disclosure thus ‘enable[s] justice to be done’.41 This explains why it does not depend on wrongdoing by the defendant: its purpose is to avoid injustice to the claimant by intervening to ‘complete the cause of action’.42 This also explains why the claimant is not required to commence proceedings: the information may be used to obtain redress by another means (such as negotiated settlement or lawful retaliation).

4.30  Property-based justifications. Disclosure is sometimes justified by reference to claimants’ property rights. As Roskill LJ remarked in Norwich Pharmacal, disclosure was necessary because ‘[o]therwise rights accorded them under patents...are denied them’.43 This is, of course, an incomplete explanation, since disclosure orders extend beyond primary wrongs involving property. These statements reflect the idea that by facilitating some interference with the claimant’s rights, the defendant has incurred a new obligation to preserve the integrity of the claimant’s secondary rights to a substitutive remedy. Disclosure protects those secondary rights by enabling them to be meaningfully exercised against the true wrongdoer.

4.31  The price paid for substantive immunity. Disclosure may also be thought of as the price which must be paid for immunity from monetary liability, since equitable facilitators are not, as a general rule, liable as joint tortfeasors for mere assistance. Strong disclosure obligations complement that immunity by ensuring that the claimant is able to identify and seek redress from a tortfeasor who is under a legal duty to compensate harm.

4.32  Balancing rights. The potential for injustice is a powerful reason for Norwich Pharmacal orders. However, claimants’ rights are not dispositive of an application for relief. Various limitations and countervailing factors are considered, including proportionality, the fundamental rights of third parties, the confidentiality of data that are sought, statutory limitations upon disclosure,44 and other considerations of public policy. Its essential purpose is ‘to do justice’.45 Doing justice to claimants therefore cannot be a complete explanation.

4.33 A second category of justifications frames the remedy in terms which accommodate this delicate balancing of public and private interests: disclosure is said to be an incident of the ‘duty of the court to assist with the administration of justice’.46 This explains why equity protects the mere witness from disclosure suits even though they might possess relevant information: examination as a regular witness is more proportionate to their degree of involvement and the legitimate aim of seeking redress against the primary wrongdoer.47 Such third parties hold a legitimate expectation that they will not be intruded upon and swept up in litigation. When given, disclosure upholds the rule of law by ensuring that claimants can bring their causes before competent tribunals rather than relying upon self-help or forbearance.

4.34  Causation-based justifications. A related justification is based on the involvement of the respondent. According to this argument, a party who has enabled or caused wrongdoing, however innocently, is said to be more culpable than a party who had no causal connection to wrongdoing. As Lord Reid put it in Norwich Pharmacal, ‘justice requires that he should co-operate in righting the wrong if he unwittingly facilitated its perpetration’.48 This ‘duty to assist’49—sometimes described using the language of unconscionability50—is difficult to sustain, since the obligation to disclose arises regardless of whether the defendant’s facilitation is an actionable wrong. Assistance without more is not tortious,51 but it is often sufficient for disclosure. Disclosure is in reality a no-fault response to conduct causing harm, even if that conduct otherwise creates no liability.

4.35  Costs of wrongdoing. Finally, Norwich Pharmacal orders promote efficiency by compelling parties who deal with rogues and other ‘dishonest correspondents’ to internalise the cost of identifying those whose wrongs they enable. Disclosure imposes a relatively small search cost on the disclosing party compared to the large cost faced by a claimant who is forced to wear her losses or acquire the information by alternate means. This reflects the reasonable assumption that a person mixed up in anonymous wrongdoing is a lesser cost avoider than its victim, since the former already possesses information necessary for the victim to seek redress.

4.36  Relative costs and benefits of disclosure. In resisting disclosure, the natural tendency is for defendants to exaggerate the costs of compliance and urge the court to refuse relief because it would ‘cause manifest inconvenience to the citizens of this country whose only fault is that they happen to have some information that the plaintiff wants’.52 Courts have been largely unreceptive to these complaints. For example, Lord Kilbrandon in Norwich Pharmacal regarded the cost to the defendants as small compared to the benefits flowing to the claimant:  

the defendants will not be the losers, except in so far as they may have been put to a little clerical trouble. . . . [I]n total disregard of . . . loss of time and money, [they must] attend the court . . . to assist a private citizen to justify a claim in law. The policy of the administration of justice demands this service . . .53

4.37  No duty to police infringement. This passage contrasts starkly with the conclusion of Buckley LJ in the Court of Appeal, who commented that the Commissioners were ‘under no obligation to police the plaintiffs’ immunity from infringement’.54 While this is undoubtedly true, Lord Kilbrandon concluded that defendants should nevertheless ‘assist’ such policing, but only on the credible assumption that their enforcement costs are lower. Of course, in ordering disclosure, the normal approach is to require the applicant to pay the costs of the party giving disclosure,55 which reflects the primacy of considerations of fairness and the desirability of claimants internalising the cost of policing their own private rights.

4.38  Expansion of the modern remedy. Since Norwich Pharmacal, the scope of equitable disclosure has grown dramatically. As Lord Woolf CJ observed in Ashworth:

New situations are inevitably going to arise where it will be appropriate for the jurisdiction to be exercised where it has not been exercised previously. The limits which applied to its use in its infancy should not be allowed to stultify its use now that it has become a valuable and mature remedy ...56

The relaxation of those limits demonstrates the flexibility of the modern remedy and its ‘adaptation to new circumstances’,57 including the activities of internet intermediaries. It is no overstatement to describe these changes as ‘striking’58 or a ‘revolution’.59 Four aspects warrant comment.

4.39 First, the standard to which the primary wrong must be proved has progressively slackened. Norwich Pharmacal was a case in which the third parties ‘whose names are known to the commissioners are wrongdoers’,60 or could ‘reasonably be assumed to be wrongdoers’. Forty years later, the threshold has been reduced to an ‘arguable case’ of wrongdoing.61

4.40 Some authorities even suggest that disclosure is available without any primary wrong, to enable the claimant to determine whether a tort has in fact occurred,62 or to identify persons whose wrongdoing is only speculative. In Arab Satellite, for example, the trial judge ordered disclosure of any third party ‘who was or may have been involved in any way’ in trespassing upon the claimant’s satellite transponders, provided that it was possible for the applicant to ‘sort the sheep from the goats’.63 Similar logic could support an order being made to disclose a group of subscribers’ IP addresses where it is uncertain which individual was responsible for an infringement. In such a case, like Arab Satellite, the pool of possible tortfeasors must be sufficiently small to eliminate innocent parties without undue burden.

4.41  Breadth of primary wrongdoing. Although the jurisdiction has its basis in the equitable bill of discovery (at a time when the remedial powers of courts of equity were limited to granting equitable relief), its scope clearly encompasses any ‘tort, a breach of contract or other civil or criminal wrong’,64 including defamation and copyright infringement.65 There seems to be no reason in principle to preclude any wrong from founding an action for disclosure.

4.42  Orders without wrongdoing. It is doubtful whether disclosure (or any other remedy pursuant to the equitable protective jurisdiction) could be ordered where the parties are agreed that no primary wrongdoing has occurred or is likely to occur. This is because, in such a case, the disclosing party could not be said to be mixed up in any wrongdoing. However, the margins are not always clear in practice, because arguable wrongdoing may later eventuate to be lawful conduct. For example, in Warner-Lambert Company LLC v Actavis Group PTC EHF the court made an interim order analogous to disclosure against the National Health Service on the basis of arguable patent infringement by third parties.66 However, at trial, the judge concluded that no primary infringement had actually taken place.67

4.43 Second, the defendant must have facilitated the wrongdoing and so not be a mere witness. Lord Cross and Lord Kilbrandon originally described the required nexus as a ‘relation’.68 In Ashworth, Lord Woolf CJ stated that it is not a ‘stringent requirement’,69 but the defendant must have ‘participated’ or been ‘involved’ in the wrongdoing.70 In that case, innocent publication of wrongfully disclosed information was ‘emphatic’ evidence of facilitation. Lord Morris required the defendant to be ‘actually involved (or actively concerned)’71 in the wrongdoing. Other authorities prefer to describe the defendant as being ‘mixed up in’ even if not ‘causative of the wrongdoing’.72

4.44 Beyond empty synonyms it is difficult to find any clear statement of principle that establishes the necessary degree of involvement. The threshold does not appear to be high. The defendant’s actions need not have been the legal cause of wrongdoing—Thomas LJ considered this conclusion ‘plainly correct’ in Mohamed.73 Indirect or partial facilitation is sufficient. Contrary to Lord Romilly MR in Upmann v Elkan, knowledge is now unnecessary: the defendant can be ‘innocent and in ignorance of the wrongdoing’ but still under a duty to disclose.74 However, knowledge may suggest a degree of participation or involvement.75 It is suggested that the authorities may be distilled as follows: any type of assistance—that is, any necessary cause of the acts constituting the wrong—will be enough, however minor and regardless of the mental state with which it is given, provided that in so giving it the defendant is not a mere witness.

4.45 Third, disclosure must be necessary for some legitimate reason. Traditionally, the information must have supplied the vital ‘missing piece of the jigsaw’76 and the defendant must have been its only practicable source, consistent with the view of disclosure as a ‘remedy of last resort’.77 More recent cases have preferred a looser criterion: the information must be necessary only in the sense that, in all the circumstances, the balance of convenience favours disclosure.78 This is sensible, since otherwise disclosure might never strictly be necessary where multiple third parties are in possession of the same information (as is common where multiple internet intermediaries are involved at different layers).79 Thus, disclosure need no longer be strictly necessary.80 However, necessity remains an important threshold, since otherwise the interference with the rights of data subjects under articles 7 and 8 of the Charter may not be justified.81

4.46 Consistent with this flexible approach, courts do not insist upon the applicant commencing proceedings against the primary wrongdoer.82 It is sufficient that the applicant intends to take some legitimate action or have a ‘legitimate reason’ for wanting the information.83 This could be a foreign proceeding,84 as will often be the case where cross-border wrongs are perpetrated online.

4.47 Fourth, the disclosure sought must be proportionate. Traditionally, once wrongdoing, facilitation, and necessity were shown, disclosure ordinarily followed unless the defendant could point to some countervailing consideration of public policy or other legitimate interest sufficient to defeat the claim.85 Modern cases adopt the language of proportionality to frame this inquiry.

4.48  Confidentiality. That the information being sought is confidential or private is not necessarily a bar to disclosure. In Norwich Pharmacal, Lord Reid thought that wrongdoers should not be able to hide behind the confidentiality of customs data: ‘If we could be sure that those whose names are sought are all tortfeasors, they do not deserve any protection.’86

4.49  Data protection. Similarly, data protection rights impose few limits of substance. In Parkinson v Hawthorne, the Court broadly construed section 35 of the Data Protection Act 1998, which exempts disclosure necessary ‘for the purpose of, or in connection with, any legal proceedings’ or for ‘establishing, exercising or defending legal rights.’87 Patten J held that the provision ‘removes any difficulty’ and ordered disclosure of a judgment debtor’s address from a land register.

4.50  Discretion. As an equitable remedy, Norwich Pharmacal relief remains discretionary. Consistently with the overriding objective,88 disclosure must be ‘in the interests of justice’. This has been reinterpreted as a requirement of proportionality.89 In short, the Court will consider whether the difficulty and expense involved in giving disclosure or breaching a parallel duty (eg of confidence) is justified by the claimant’s interest in obtaining disclosure. Many factors will be relevant to the exercise of this discretion, including:

(a)

the urgency of the information;

(b)

its benefit to the claimant or the public;

(c)

the unavailability of reasonably viable alternatives;

(d)

the gravity of the primary wrong; and

(e)

the seriousness of the consequences if disclosure is not given.90

4.51  Availability of alternatives. Lord Bingham explained the preferred approach in Equatorial Guinea v Royal Bank of Scotland International as one which asks whether disclosure is reasonable having regard to the existence of other ‘straightforward and available means of finding out’ the wrongdoer’s identity:

Norwich Pharmacal relief exists to assist those who have been wronged but do not know by whom. If they have straightforward and available means of finding out, it will not be reasonable to achieve that end by overriding a duty of confidentiality such as that owed by banker to customer. If, on the other hand, they have no straightforward or available, or any, means of finding out, Norwich Pharmacal relief is in principle available if the other conditions of obtaining relief are met. Whether it is said that it must be just and convenient in the interests of justice to grant relief, or that relief should only be granted if it is necessary in the interests of justice to grant it, makes little or no difference of substance.91

4.52 Since Equatorial Guinea and Ashworth, it seems doubtful whether the remedy is truly ‘exceptional’ and not simply a response to wrongdoing by an unknown party.92 The focus is on whether disclosure is, in all the circumstances, a proportionate response to the respondent’s participation in that wrongdoing and the claimant’s other remedies.

4.53 At least in the context of intellectual property, an effective disclosure remedy is essential to comply with EU law. These obligations affect Norwich Pharmacal applications in two ways. First, they place lower limits on relief by requiring that a ‘right of information’ be available, effective, and part of national systems of remedies. Second, EU law places upper limits on relief by requiring that disclosure be proportionate, necessary, and fairly balanced with competing fundamental rights. These maximum standards are especially important online because of the potential for excessive disclosure to chill speech and intrude upon the right to private life. They indicate that the public policy of access to justice is not absolute, and must occasionally yield to other interests—even at the expense of claimants’ rights.

4.54  The right of information. In intellectual property cases, article 8(1)(c) of the Enforcement Directive requires disclosure to be available against a party who supplies services used in infringing activities on a commercial scale. This ‘right of information’ allows the claimant to make a request for information about the origin and distribution networks of infringing goods or services and, where the request is ‘justified and proportionate’, the national court is required to order disclosure of that information.93 The purpose is to enable right-holders to obtain precise information about the origin of infringing goods or services, their distribution channels, and the identity of infringers.

4.55  Injunctive relief. As articles 9(1)(a) and 11 also make clear, claimants must also be able to obtain injunctions against intermediaries whose services are used to infringe.94 In eBay, Arnold J considered that it was unclear whether article 11 required the equitable protective jurisdiction to be extended to a marketplace intermediary which facilitated trade mark infringements.95 Later cases have gone further, and are discussed in chapter 14. However, it seems clear that where an internet intermediary facilitates wrongdoing, it will be required to disclose what it knows about the primary infringer, even if it is not in a position directly to bring the infringements to an end. In some cases, this may be sufficient to comply with articles 9 and 11.

4.56  Intellectual property cases. EU law imposes mandatory limits upon the kinds of injunctions available against internet intermediaries. A disclosure order could be incompatible with EU law if it failed to respect those limits—for example, by not striking a fair balance between the parties’ fundamental rights, or by being disproportionate or excessively costly. These limits are discussed further in chapter 13.

4.57  Other cases. It remains unclear to what extent Norwich Pharmacal orders are subject to the same restrictions outside intellectual property cases,96 though courts will need to ensure that any orders they make are compatible with Charter and Convention rights.

4.58  Proportionality of disclosure. Deciding whether a particular application for disclosure is proportionate is a fact-sensitive exercise, and it will be necessary to consider all relevant circumstances. However, disclosure is more likely to be proportionate and compatible with EU law if it respects a number of limits.

4.59 First, a disclosure obligation must be of clearly defined scope and duration, such as by listing specific user accounts or records held at a particular point in time.

4.60 Second, because disclosure interferes with the right to privacy by identifying individuals, it must be necessary and proportionate to a legitimate aim; for example, preserving the right to a fair trial and the protection of the applicant’s substantive rights.97

4.61 Third, claims for disclosure (even if unopposed) must be subjected to judicial scrutiny in order to ensure that the procedures contain ‘adequate and effective safeguards against abuse’.98 As the CJEU held in Bonnier, any disclosure procedure which accommodates a discretionary assessment of proportionality and ‘weigh[s] the conflicting interests’ is likely to strike a fair balance.99

4.62 Fourth, the allocation of costs between the applicant and the disclosing intermediary will be relevant to the assessment of proportionality. Disclosure is more likely to be proportionate if it represents a minor expense, especially if the applicant undertakes, or is required, to pay the costs of disclosure.

4.63 Fifth, unlike other kinds of injunctions against intermediaries,100 properly delimited disclosure orders do not normally involve wholesale scrutiny of the contents of electronic communications—only the use of identity metadata (typically IP addresses and contact information) to unmask an anonymous internet user who is, or is likely to be, a wrongdoer.

4.64 Finally, unlike blanket monitoring, disclosure orders distinguish between lawful and unlawful content by first requiring proof of a reasonable allegation of wrongdoing. Provided these limits are properly reflected in an order for disclosure, it therefore seems likely that Norwich Pharmacal disclosure can strike a ‘fair balance’ between fundamental rights that is compatible with European law. However, this assessment will ultimately depend on the scale, purpose, and subject of disclosure that is sought in a particular case.

4.65  Overview. Where a website or other platform facilitates wrongdoing, disclosure will normally be ordered against an operator who possesses information concerning the wrongdoer, unless the cost or other negative consequences of doing so are disproportionate to the loss suffered (or likely to be suffered) by the claimant.

4.66 The cases may be divided into two main categories. In the first, the defendant administers a discussion forum, weblog, or other application-layer service to which allegedly tortious information is posted by an anonymous author. The primary wrong lies in the publication or disclosure of the information, as the case may be, and the claimant seeks to learn the author’s identity.

4.67 In the second category of case, an online marketplace or payment processing service facilitates tortious activities, such as trespasses or breaches of contract, by third parties in the real world. There the transmittal is necessary but antecedent to the tort, and the claimant seeks to know who took part in it.

4.68  General rule. In general, the principles applied in disclosure cases involving internet defendants are identical to those applied offline. However, particular factual considerations arise—in particular the privacy interests of internet users—which are relevant to the exercise of the court’s discretion.

4.69 Several guiding criteria were set out in Totalise plc v The Motley Fool Ltd, where disclosure was ordered against the operator of a discussion forum in which a malicious campaign of abuse was conducted against the claimants by an anonymous user.101 This approach was later adapted in Rugby Football Union v Viagogo Ltd102 to apply a two-stage test based on necessity and proportionality. The authorities now suggest that whether users’ or claimants’ rights should prevail in a given case depends on several factors.103

4.70 First, the Court will consider the nature and gravity of the tort alleged. Publication to a ‘vast’ or worldwide audience of ‘plainly’ tortious material will favour disclosure;104 more limited publication of trivially tortious material may not.

4.71  Trivial wrongs. An example can be seen in Sheffield Wednesday Football Club Ltd v Hargreaves,105 where messages had been posted pseudonymously to a discussion forum for fans of the Sheffield football club by forum users who were unhappy with the club’s management. The claimants considered these messages defamatory and sought disclosure of the email addresses of eleven forum members. Although several messages contained arguably false and defamatory statements, they were mere ‘saloon-bar moanings’ with a ‘smidgeon of personal abuse’106 and only trivially defamatory. The Court exercised its discretion to refuse disclosure of their authors because to do so ‘would be disproportionate and unjustifiably intrusive’.107 HHJ Parkes QC ordered disclosure only in respect of the more serious postings which alleged dishonesty—there the claimants’ rights to vindicate their reputations outweighed the privacy interests of users.

4.72  Preventing pointless or abusive claims. In requiring a threshold of seriousness before disclosure will be ordered, the Court can refuse disclosure in relation to wrongs which, although arguable, are insubstantial or trivial. This litigation filter indirectly protects the interests of website users by preventing them from being exposed to the cost and inconvenience of defending an action which is unlikely to serve any legitimate purpose. To this extent, the filter goes beyond the ‘arguable wrong’ requirement; it both complements and pre-empts the Court’s power to strike out a claim as an abuse of process pursuant to the Jameel doctrine.108 The filter creates an additional threshold to justify the perceived inconvenience of depriving users of their anonymity without notice. Conversely, if disclosure would deter similar wrongdoing by others, this may favour relief even if the primary wrong is not particularly serious.109

4.73 The second factor is the applicant’s likelihood of success in the primary action; a weak or speculative claim is less likely to support disclosure.

4.74 In Clift v Clarke,110 Sharp J refused an order against the editor of a news website on which offensive comments were posted about the claimant by pseudonymous users. Referring to Sheffield, Sharp J held that disclosure of the commenters’ identities would be disproportionate having regard to the weakness of the primary claims in defamation; from their nature and context, the comments were unlikely to carry defamatory meanings and a defence of honest comment was available.111 In reality, the postings were merely ‘pub talk’: abusive but light-hearted statements that were unlikely to be taken seriously by reasonable readers.112 Accordingly, disclosure should have failed by reason of there being no primary wrong at all.

4.75 Like Sheffield’s requirement of ‘substantiality’, the strength of the applicant’s claim functions as a litigation filter which shields website users and intermediaries from disclosure in support of actions which are clearly doomed to fail. This complements and pre-empts the Court’s power to grant summary dismissal. It is suggested that courts should not order disclosure in support of a claim which would be strikeable even if the correct defendant were identified.113 More generally, any preliminary indications as to the strength of the applicant’s claim will plainly be highly material factors when assessing the proportionality of disclosure, since the justification for interfering with a presumed wrongdoer’s fundamental rights becomes progressively weaker as the merits of the primary claim decrease.

4.76 A third factor is whether, in the circumstances, platform users have a reasonable expectation that their personal data will not be disclosed. Although such disclosure is permitted under section 35(1) of the Data Protection Act 1998,114 the fifth and sixth data protection principles require the Court to be satisfied that disclosure is warranted having regard to the rights and freedoms or legitimate interests of the data subject.115

4.77  The two-stage inquiry. For this purpose, the Court must give ‘close consideration’ to whether disclosure would unjustifiably invade users’ Convention and Charter rights to respect for their private life and personal data.116 This inquiry has two distinct stages:

(a)

first, asking whether the user holds a reasonable expectation of privacy in respect of the data of which disclosure is sought; and

(b)

second, asking whether, after balancing that expectation against the public interest in disclosure, the scales are tipped in favour of the claimant.

4.78  Relevance of privacy policies. The starting point in answering the first of these questions is normally the website’s terms of service and other policies. In Sheffield, the forum’s policies prohibited defamatory and abusive language, and offered no guarantees of secrecy to users. In Clift, the website’s terms prohibited the posting of defamatory or abusive material but safeguarded commenters’ personal information from disclosure, except as required by law. Those courts held that in the latter case, users enjoyed a reasonable expectation of privacy, but in the former case they did not. The conclusion in Clift is open to question because the postings were probably abusive and therefore violated the policy as stated. The decision is therefore better treated as resting on the basis that there was no arguable wrongdoing.

4.79 In practice, once arguable wrongdoing is established, courts very rarely prioritise the interests of potential tortfeasors. In Totalise, Owen J concluded that:

the respect for and protection of the privacy of those who chose to air their views in the most public of fora must take second place to the obligation imposed upon those who become involved in the tortious acts of others to assist the party injured by those acts.117

4.80 Similar reasoning was applied in Viagogo to order disclosure against an online marketplace which provided a secondary market for sporting tickets. The defendant had advertised tickets to the claimant’s rugby matches at Twickenham, which were being resold by third parties—often at substantial premiums over their face value—contrary to the original terms of sale. The defendant generally did not sell the tickets itself but merely facilitated transactions between third parties, whose names and addresses it retained. The claimant sought disclosure of this information for the purpose of bringing proceedings against sellers for breach of the ticket conditions, conversion of the paper ticket, and jointly committing trespass with buyers who falsely gained admission to matches using a resold ticket.

4.81 The trial judge, Court of Appeal, and Supreme Court all agreed that sellers and buyers of resold tickets did not have a reasonable expectation of privacy. Viagogo’s terms of use expressly contemplated disclosure under compulsory legal processes and, in any case, arguable wrongdoers cannot wear the mantle of privacy to conceal their arguable wrongs:

There can be no reasonable expectation of privacy in respect of data which reveal such arguable wrongs and Viagogo’s own conditions of business point out to their customers that ...their personal data will be passed on to others.118

4.82 From an analysis of the contractual matrix and evidence of unauthorised ticket sales, Longmore LJ concluded that there were at least arguable claims of breach of contract and trespasses for which sellers may be held jointly liable.119 Accordingly, Viagogo’s customers could not invoke privacy to conceal these allegations of misconduct. Obtaining injunctive relief against ticket sellers was a legitimate purpose of disclosure notwithstanding that claims for damages may be insubstantial or may ultimately fail.120 The Supreme Court took an even broader view of the claimant’s purpose, which should not be considered ‘in a hermetically sealed compartment’; it was enough simply to seek disclosure with a view to deterring others from buying or selling tickets unlawfully in the future.121

4.83  No requirement of ‘strict necessity’. Both appellate courts rejected Viagogo’s submission that section 35(1) must be construed to apply only where disclosure is ‘strictly necessary’ and proportionate to the purpose of protecting the claimant’s rights, as explained by the CJEU.122 Either standard would be satisfied where disclosure only encompasses the personal data of arguable wrongdoers. If all users of Viagogo who transacted in tickets to Union matches presumptively breached the applicant’s conditions by advertising or purchasing resold tickets, there were no ‘innocent’ users whose expectations of privacy might be infringed.123 At most it could be said that they were ignorant that what they were doing was tortious, which was irrelevant. Moreover, there was no particular sensitivity or confidentiality in ticket sales data (unlike, perhaps, downloaders of pornographic copyright-protected films). Accordingly, disclosure was in the interests of justice.

4.84 For similar reasons, the Supreme Court in Viagogo rejected an argument that disclosure would be contrary to users’ rights under article 8 of the Charter. In upholding the order for disclosure, the Court was clearly motivated by its impression of the ‘entirely worthy’ motives of the claimant in seeking to promote Rugby Union and reduce the price of tickets—efforts that were frustrated by the defendant’s anonymous marketplace, which enabled ticket touts to act ‘in stark breach’ of the claimant’s terms and policies.124

4.85  Disclosure of alleged infringers’ personal data. In BT, the Court of Appeal endorsed an equally broad approach to section 35. Although the Digital Economy Act 2010 was primarily designed to educate infringers rather than result in legal claims being brought against them, disclosure and processing of repeat infringers’ identities still fell within the exemption in article 8(2)(e) of the Data Protection Directive (corresponding to section 35 of the 1998 Act) since it was ‘plainly necessary’ for establishing, exercising, or defending claimants’ legal rights.125 If this reasoning becomes orthodoxy, privacy will offer illusory protection against disclosure in most cases.

4.86 Fourth, disclosure is more likely to be granted if there are no realistic alternatives open to the claimant to protect its rights. In Viagogo, the claimant could theoretically have made trap purchases, inquired of its distributors and club sponsors, or conducted spot checks at stadium entrances, but these alternatives were either excessively costly or unlikely to be met with cooperation from clubs (who risked paying contractual penalties) or patrons who were refused admission.

4.87 Whether disclosure is ‘necessary’ is a question of whether, absent disclosure, there exists any ‘straightforward or available means of finding out the information’126—a lower threshold than Norwich Pharmacal or even Mohamed.127 Disclosure will be necessary if there is no other practicable way to identify or stop wrongdoers.128 While the lack of alternatives will often favour a finding of proportionality, it is not inevitable; in ‘limited instances’, data subjects’ rights may be so strong as to displace the claimant’s interest in disclosure.129 Nevertheless, Viagogo clearly demonstrates that internet platforms can be brought within the protective jurisdiction even where disclosure is not ‘strictly necessary’ because alternative (but impractical) sources of information about primary wrongdoers exist.

4.88 Fifth, the Court will evaluate the cost and impact of disclosure to the website operator against the importance of the information to the claimant. An example can be seen in Microsoft Corporation v Plato Technology Ltd,130 where Norwich Pharmacal relief was refused against a distributor who innocently resold counterfeit software because the orders sought against it would be ruinous to its business.131 Compared to the small scale of infringement, the impact on the defendant was oppressive and disproportionate.

4.89 By contrast, in Viagogo the Court rejected the defendant’s submission that disclosure would deter individuals from using its marketplace for legitimate sales. Greater harm was being caused to the claimant by unauthorised ticket sales. This is unlike Plato, where only a small number of counterfeit copies were sold and there was no evidence of ongoing harm.

4.90 Sixth, the Court will examine the conduct of the platform operator. If the defendant ‘supported’ the tort or acted to ‘obstruct justice’, then disclosure is prima facie appropriate.132 If, however, the defendant acted reasonably, then the claimant will bear the onus of establishing that a refusal to disclose voluntarily was unjustified. In most cases, this will not be a difficult hurdle, as two cases involving neutral services demonstrate.

4.91 First, in G v Wikimedia Inc,133 an unknown third party had edited a page on Wikipedia to include confidential information about the applicant and her child. The claimant sought the author’s IP address. Wikipedia refused, citing its policy of not releasing personal information without a court order, but did not oppose the claimant’s application, which the Court granted without further elaboration.

4.92 Second, in Bacon v Automattic Inc,134 similar orders were made against Wikipedia, a weblog platform, and an American news website. Each defendant had innocently disseminated anonymous defamatory postings and refused to disclose their authors’ identities voluntarily. Although they were not suggested to be liable, Tugendhat J again granted permission to serve outside the jurisdiction. Immunity from monetary liability did not exclude these service providers’ non-monetary disclosure obligations.

4.93 Orders against hosts are less common, and only a handful of reported cases exist. Nevertheless, it is clear that proprietors and operators of web servers may owe duties to disclose information stored on them.

4.94  Server data. Such information commonly takes the form of email messages, access logs, routing information, and other technical data which can be used to identify a tortfeasor. Hosts facilitate primary wrongdoing in similar ways to website operators: typically by storing or routing data that are essential to wrongdoing. For example, Blogger ‘plainly facilitates’ the storage and publication of defamatory postings.135

4.95  Emails and metadata. Participation does not always require tortious content to be published on the public internet; it may be transmitted or stored privately. In Takenaka (UK) Ltd v Frankl, the claimants obtained information about a defamatory email from a number of hosts, including Microsoft’s Hotmail and Compuserve. That information enabled the claimants to trace the origin of the email to the defendant’s computer in Turkey.136 In another case concerning emails, the respondent had received a message containing wrongfully obtained confidential information. It notified the claimant, who obtained disclosure of the sender so it could identify the source of the leak.137

4.96 In Lockton Companies International v Google Inc138 the claimants identified the authors of tortious emails which had been sent anonymously using Google’s Gmail mail server. Although the server was operated in the United States, Eady J held that disclosure was appropriate on well-established principles.139

4.97  Blogs. In Jirehouse Capital v Persons Unknown the claimants obtained disclosure against the host of materials alleged to infringe the claimant law firm’s copyright in its logo, pass themselves off as the claimants’ website, and defame one of its lawyers.140 The material was hosted on the WordPress blogging platform. WordPress maintained records of the IP address and contact information supplied by the creators of the blog, which was also ordered to be disabled pending trial. A subsequent application against an English ISP allowed the IP address to be traced to a subscriber account in the United Kingdom.

4.98 Disclosure orders are routinely made against English ISPs that transmit data on behalf of subscribers engaged in tortious activity. Their purpose is usually to enable a claimant to discover the account holder associated with an IP address which is suspected of being connected with wrongdoing at a particular time.

4.99  Bulk disclosure. Some actions for disclosure against ISPs have been commenced in bulk in an attempt to identify many thousands of IP addresses, frequently but not always for the purpose of asserting copyright infringement. This typically involves uncovering the personal information of subscribers, such as their names and addresses and, in some circumstances, details of their browsing history and accessed files. These attributes—scale, untested claims, and private data—create considerable potential for abuse. Nevertheless, in most cases disclosure will be an uncontroversial exercise of the equitable jurisdiction, and the courts have struggled to articulate meaningful limits on the use of disclosed subscriber data.

4.100 English courts treat ISPs analogously to other telecommunications carriers. In this respect, almost any facilitation is sufficient for disclosure. Only a handful of cases have considered this issue.

4.101  Telephone carriers. In Coca-Cola Company v British Telecommunications plc,141 Neuberger J ordered the respondent telephone company to disclose the name and address of an account holder who used his mobile telephone to coordinate the sale of infringing soft drink syrups to hoteliers.

4.102 Facilitation was established because these telephone services were probably ‘of central significance’ to the delivery of infringing goods.142 BT’s ‘degree of mixing up’ in primary wrongdoing was otherwise slight: it never took possession of infringing goods, and the phone was used predominantly for non-infringing activities; it merely supplied lawful services which were used to effect the subscriber’s scheme. Neuberger J accepted that this was ‘a less strict view’ of the traditional facilitation requirement.

4.103  ISPs. By analogy, it appears that where an ISP’s services are a ‘central’ or ‘essential’ element in the commission of a tort, it will be taken to have facilitated the tort in a manner sufficient for Norwich Pharmacal disclosure.

4.104  Automated harvesting techniques. Most applications for disclosure rely upon IP addresses collected by rights-monitoring companies using automated technical processes. Courts tend to accept this evidence at face value.143DigiProtect Gesellschaft Zum Schutze Digitale Medien GmbH v BE UN Ltd144 is a typical case. There the claimant was a digital enforcement company which used BitTorrent monitoring software to compile a list of IP addresses from which copyright works had been uploaded, and sought disclosure of their identities from nine English ISPs. Disclosure was ordered, with all costs to be paid by the applicant.145

4.105  Potential difficulties. Media CAT Ltd v Adams illustrates the difficulties that can arise.146 The applicants purported to be ‘representatives’ of various copyright owners from whom they licensed the right to enforce copyright against infringers in return for a share of damages recovered. Using proprietary technology, the applicants determined that some 30,000 IP addresses on the respondents’ networks were sharing the licensed works using P2P file-sharing applications. The works were all pornographic in nature. In an unreported decision, Chief Master Winegarten ordered Plusnet plc to disclose the name and address of the subscriber to whom each IP address was assigned at the relevant time.147 The applicants did not allege that the ISPs were liable, but it was not disputed that the ISPs facilitated subscribers’ infringements and were therefore mixed up in wrongdoing. In another unopposed application, BT was ordered to disclose similar information.148

4.106 The ISPs gave disclosure. However, instead of bringing proceedings against the identified third parties, the applicants then commenced a letter-writing campaign of considerable magnitude. Their letters demanded a settlement fee—typically £495 or £800—as ‘compensation’ for infringement and costs, in return for which the matter would be taken no further and their identities kept private. The applicants’ solicitors, who were entitled to 65 per cent of recoveries, sent letters which materially misrepresented the applicants’ case and did not sufficiently explain that no finding of actual infringement had been made. Unsurprisingly, many recipients paid up—though it is unclear just how many. Of those who did not, only 27 actions were commenced, and after failing to obtain ex parte judgment149 the applicants sought discontinuance of the actions and took no further steps to advance them. The notices of discontinuance were later struck out as an abuse of process, since the applicants lacked standing and their collateral purpose was to prevent the claims from ever being tested in court.150

4.107  Criticisms of bulk disclosure exercises. Media CAT is an unfortunate example of how seemingly uncontroversial disclosure orders can be misused on a vast scale. The remedy of disclosure was used to perpetrate a scheme in which parties were given no realistic prospect but to submit to a demand of payment for a wrong for which they may or may not have been responsible, where liability was never determined by a court, and where the quantum of payment was not necessarily commensurate with the degree of harm suffered.151 The entity issuing the demand lacked title to sue, was unconnected with the proper claimant, and removed from the incentive structure contemplated by copyright law. As can be seen from the enormous quantity of critical discussion online,152 the use of disclosure for this purpose is liable to undermine public confidence in the administration of justice and to bring the legal profession into disrepute.153

4.108  Safeguards. The fact that serious injustice can be caused by improper use of identity information underscores the importance of placing appropriate limitations upon disclosure.154 It also illustrates that future applicants for disclosure orders should be wary of framing their claims in a manner that is heavy-handed or disproportionate, or which misrepresents the nature of their claim or the evidence in support of it. Although there are good reasons to encourage bona fide attempts at settlement, demanding sums far in excess of the applicants’ likely losses under threat of public humiliation is clearly not a legitimate purpose for disclosure.

4.109  Further examples. Media CAT is far from the only example of ‘speculative invoicing’.155 However, courts are scrutinising the use of Norwich Pharmacal orders more closely. In Golden Eye (International) Ltd v Telefónica UK Ltd,156 the first claimant sought disclosure of the identities associated with 9,124 IP addresses, from which it alleged that the subscribers had infringed its copyright by uploading or downloading the claimants’ pornographic films using BitTorrent. The first and second claimants owned some copyrights in their own right; the remainder had been licensed under an arrangement with the other 12 claimants whereby the first claimant would receive up to 75 per cent of damages recovered from internet infringers. It proposed to send letters to each subscriber offering to settle claims for £700. The defendant ISP did not oppose the order or make submissions. However, Consumer Focus, a consumer watchdog, intervened on behalf of the affected subscribers.

4.110 Arnold J granted disclosure to the first and second claimants, but refused relief to the remaining 12 claimants. The traditional Norwich Pharmacal requirements were clearly established, there being a good arguable case that ‘many, but not all’ of the subscribers had infringed copyright, which the ISP had facilitated.157 Disclosure was ‘plainly necessary’ to enforce the claimants’ copyrights,158 though there would inevitably be some percentage of identified subscribers who were not infringers (eg due to errors in the ISP’s records or because someone else was using the relevant connection). In light of the large number of potential defendants and the low value of each claim, it was unnecessary for the claimant to intend to pursue every infringer: merely sending pre-action letters was a legitimate purpose since motivated by a ‘genuine commercial desire...to obtain compensation’.159 In these circumstances, the claimants were prima facie entitled to disclosure, subject to an analysis of proportionality.

4.111 In Golden Eye, privacy was treated as a question of balancing the competing rights of copyright owners and users. Arnold J applied the traditional approach, focusing on the relative importance of each party’s right and the justifications for interference, before applying the ultimate balancing test of proportionality.160 Relevant here was the fact that most subscribers were retail consumers who may be innocent of any wrongdoing. Further, the pornographic nature of the allegedly infringed works may cause embarrassment or distress, and lead recipients to settle unmeritorious claims. Notwithstanding these factors, the claimants’ legitimate need to enforce their property rights—whose infringement was widespread—still outweighed the subscribers’ privacy rights. Disclosure was accordingly proportionate if appropriate safeguards were adopted to protect subscribers’ rights and, in particular, those who were innocent of wrongdoing.161

4.112  Judicial supervision. The most important safeguard was the Court’s supervision of pre-action correspondence to ensure that it was not misleading or otherwise objectionable. Arnold J excised several passages from the proposed letters of demand, including the specific sum of money claimed in settlement (since the precise loss claimable from each recipient would vary, and might in some cases be zero), and required other passages to be written in more restrained language.162 This supervisory role is clearly important if abuse is to be prevented. Additionally, Arnold J recommended the selection of ‘suitable test cases’ by the claimants so that common issues could be determined at an early stage before an appropriate tribunal.163

4.113  Disclosure to licensees. In Golden Eye, the Court refused disclosure of data related to copyrights whose enforcement had been licensed to the first claimant, since to permit aggregation of disclosure rights in return for a share in recoveries ‘would be tantamount to the court sanctioning the sale of the [subscribers’] privacy and data protection rights to the highest bidder’.164

4.114 The Court of Appeal overturned this restriction, since the licence agreements were not champertous and there was, strictly speaking, no ‘sale’ of privacy rights. Arnold J’s restriction would have placed clear limits on the ability for copyright owners to enter into business arrangements with third parties to litigate on their behalf. While it would not prevent those parties from seeking disclosure directly, it would effectively reduce the potential for bulk disclosure applications.165 It is regrettable that the Court of Appeal has removed the only effective limitation on large-scale commercial disclosure.

4.115  Advertising. In Grant v Google UK Ltd,166 Rimer J ordered Google to disclose information identifying a keyword advertiser who had placed AdWords listings on Google’s search engine. The advertisements directed users to a website containing infringing material, which used a domain name cloaking service to shield the registrant’s identity.167 Google did not oppose disclosure but refused to give the information voluntarily, citing its privacy policy.168Grant is therefore a good example of how Norwich Pharmacal orders can facilitate meaningful relief. The infringing website had already been suspended after complaints were made to its host, but the claimant also sought monetary relief for losses caused by the infringements. In this way, disclosure supported her primary remedy even after the tortious content had been removed.

4.116  Search history. A more pressing but hitherto unexamined issue is whether Norwich Pharmacal orders can be used to obtain details of an individual’s search history. Such data are commonly stored for the purposes of algorithm improvement, behavioural advertising, personalised results, and law enforcement. Their usefulness to claimants is obvious: such data might show a browsing trail leading to infringing content, disclose upload or publication activity, or simply reveal a party’s state of mind at a particular time. Because people tend to use search engines as a research tool of first resort, this information is becoming increasingly sensitive and may have very significant probative value. Even when data are retained in an anonymised format, identification is possible by aggregating fragments about an individual’s location, behaviour, workplace, and demographics.169

4.117 Although the matter has not yet arisen for decision, it is suggested that courts should be slow to acquiesce to requests for search history data and, in any event, careful to ensure that the scope of disclosure is properly confined. First, search data invite fishing expeditions and inevitably involve disclosing data beyond the identity of the tortfeasor—something the Norwich Pharmacal procedure was never designed to accomplish.170 It would be difficult to limit the scope of disclosure to tortious activity, since search histories—even within a given date range and keyword set—may include many unrelated activities.

4.118 Second, users can demonstrate strong expectations of privacy in respect of their search queries.171 The privacy policies of Google and other search engines reinforce this belief in the sanctity of search data. Users’ query behaviour suggests that they regard their search queries as visible by them alone (a conclusion supported by the relatively high volume of queries for adult material compared to the prominence of public requests for such material). Unlike commenters on public bulletin boards, search engines are not public fora, so the rationale offered in Totalise does not apply.

4.119 Third, to disclose private browsing histories may well be disproportionate when (except in very limited cases) the browsing activity does not itself constitute a tort. Querying a search engine may be a mere preparation for tortious activity; it may trigger the display of tortious material or references to it, but will not of itself constitute any known tort which the search engine facilitates.172 Finally, there is a real argument that disclosure would inhibit candour between users and search engines, which would correspondingly diminish their ability to access information freely—a recognised component of the right to freedom of expression. Such a result would be concerning because, in an age where a search engine is an extension of the inquiring mind, it leads to the undesirable result that users self-censor their thoughts or go without access to information they may have a legitimate interest in receiving.

4.120 Applications for disclosure against social networks fall to be determined according to conventional principles. Social networks are in possession of a wide variety of data which can prove useful in the investigation of wrongdoing occurring on their platforms.

4.121  Activity logs. In Applause Store, the Court ordered disclosure of information relating to defamatory postings on Facebook. These activity logs included various time-stamped events such as when the defendant logged in and out from an account and posted content, which were instrumental in the Court’s conclusion that he was responsible for the postings.173 Disclosure against social networks has also been used to unmask the perpetrators of campaigns of social harassment174 and threatening emails sent to Members of Parliament.175

4.122Applause Store illustrates the expanding scope of identity information. Identity in the narrow sense involves names and contact details; in the broad sense used in Applause Store, it implicates a growing sphere of circumstantial data which are sufficient to pinpoint one person as the author of the tortious material and reconstruct a version of events which supports the claimant’s case. This is a logical progression: Norwich Pharmacal relief is designed to be pragmatic, and should include all information ‘necessary’ to pursue the tortfeasor; however, it also raises concerns about the proper scope of social identity data, much of which will be irrelevant to the tort or unnecessary to bring a claim.

4.123 Internet intermediaries who receive an application or informal request for disclosure typically have three options available to them: they may accede to the request and give disclosure voluntarily and informally; they may oppose the application; or they may require an order to be made but adopt a neutral (or even positive) stance in proceedings.

4.124  Relevant considerations. A service provider will need to consider the details of the request in order to determine the most appropriate response. In most cases, this requires an assessment of six matters:

(a)

Merits. The service provider should consider, on the basis of the material submitted by the applicant, whether there appears to an obvious or at least seriously arguable cause of action for primary wrongdoing, and an explanation of how the service has facilitated that wrongdoing.

(b)

Gravity. The service provider should consider how serious the claim of wrongdoing is. If the wrong, even if proved, would be trivial, disclosure may be inappropriate.

(c)

Proportionality. The service provider should consider whether there are any practical alternative ways to obtain the information sought (eg searching other publicly available sources), and the impact of the order on innocent users and other third parties.

(d)

Safeguards. The service provider should consider whether any safeguards are desirable to protect users’ interests (eg notice to the affected users).

(e)

Statutory restrictions on voluntary disclosure. The service provider must determine whether or not the requested data were intercepted communications or were retained pursuant to a data retention request. If they were, voluntary disclosure of the data may be unlawful.176

(f)

Costs. Ordinarily, the applicant for disclosure would be required to bear the costs of responding to the application and of giving disclosure. The service provider should make a summary assessment of its likely costs and invite an undertaking to be given to this effect.177

4.125 This section deals with several practical considerations that arise when requests for identity disclosure are made to an internet intermediary.

4.126  Relevant information to include. A claimant or prospective claimant who seeks information from an internet intermediary should at the first instance make a written request for that information. The request should state, at a minimum:

(a)

the identity of the party seeking disclosure;

(b)

details of the wrongdoing allegedly carried out (including a clear statement of what the cause of action would be, and details of any claim already commenced);

(c)

details of how the service provider has facilitated that wrongdoing, including any relevant IP addresses, URL, email addresses, or other evidence;

(d)

an explanation of why disclosure is needed;

(e)

the purpose for which disclosed data will be used;

(f)

a statement as to whether section 35 of the Data Protection Act 1998 applies to permit voluntary disclosure; and

(g)

an indication of the applicant’s position on the costs of disclosure.

4.127 When sending such a request to an internet intermediary, it is sensible to ask that they take steps to preserve any data that are likely to be the subject of an application for disclosure. This ensures that the data can be copied and safeguarded from periodic data destruction practices that might otherwise occur during the normal operation of the service in the period between making a request and obtaining a final order for disclosure. Many hosting services have a weekly or monthly log rotation, after which old access logs are wholly or partially deleted. Most European service providers retain message and login metadata for the duration of the data retention period, which in many cases is 6 months, but the content of messages may be deleted much earlier. This makes it important to request disclosure as promptly as possible upon becoming aware of wrongdoing.

4.128 The notice should also ask the service provider to indicate whether or not they are prepared to give disclosure of the information voluntarily and, if they are not, whether they will oppose or consent to a formal application for Norwich Pharmacal disclosure. Except in urgent cases, the service provider should be given a reasonable opportunity to consider the request before any application is made. Following this approach may avoid wasted costs.

4.129 Potential claimants are restricted from using a range of self-help mechanisms to locate the defendant because of the risk of criminal liability for intercepting and disclosing transmitted telecommunications data.178 Instead, the Norwich Pharmacal jurisdiction regulates anonymity by appointing courts to supervise internet intermediaries in their roles as proxy gatekeepers of users’ identities. Care should be taken not to substitute a self-help remedy for disclosure through the proper channels if to do so would expose the claimant or its advisors to potential criminal liability.

4.130 If an informal request appears to be strong and the prospective applicant is prepared to give appropriate undertakings concerning the use of the disclosed data, costs, and data security, the receiving intermediary may consider whether to give voluntary disclosure.

4.131  Relevant considerations. Before giving disclosure voluntarily, an intermediary should consider a number of matters:

(a)

whether there is any genuine doubt that the requesting party is entitled to disclosure of the information it has requested;

(b)

whether the intermediary is lawfully entitled to disclose the requested information without a court order (eg pursuant to its terms of service and other obligations to recipients of its service);

(c)

whether the intermediary might be subject to proceedings (eg brought by a customer) or other regulatory action if disclosure were to be given voluntarily;

(d)

whether giving disclosure might lead to any damage being suffered by the intermediary (including reputational risks); and

(e)

whether the information being sought would implicate the legitimate interests of any other person (eg a third party mentioned in the information).179

4.132  Voluntary disclosure and costs. The stance taken by a disclosing intermediary may be relevant to the question of costs. An intermediary may expose itself to the risk of an adverse costs order, or no order as to its costs, if it unreasonably obstructs or opposes disclosure in an obvious case. For example, if the intermediary has previously given (or been ordered to give) disclosure of similar information in relation to the same or similar wrongdoing, and there is a further request in an obviously related case, then it may be unreasonable to refuse it.

4.133  Refusal of disclosure. In most cases it will be appropriate to have the issue of disclosure determined by a court. This is particularly the case where:

(a)

the request is novel;

(b)

the requested information is of a sensitive nature;

(c)

the request relates to data identifying multiple recipients of the intermediary’s service;

(d)

there is realistic doubt about whether the intermediary’s terms of service permit disclosure; or

(e)

the request relates to data retained pursuant to a data retention or interception request and voluntary disclosure could or would contravene a statutory restriction.

4.134 Where the merits of the request are more marginal, or where there are stronger countervailing interests, the service provider can properly indicate that a court should determine the request. Unless an internet intermediary is unusually dedicated in its assessment of allegations, a professional tribunal is likely to make more reliable decisions and better accommodate the rights of third parties than one motivated only by expedience and self-interest. In many cases, the use of a judicial procedure would be more consistent with the rule of law, since it would ensure that even a preliminary determination of the claim must be conducted in accordance with law by a competent tribunal. This legitimates what might otherwise be a serious misuse of private information or breach of contract. At a more practical level, it also ensures that the internet intermediary’s customers understand that disclosure is occurring by compulsion and not because of a decision by the service provider.

4.135  Reputational risks. Consistent with the principle of open justice, Norwich Pharmacal hearings are listed and, in all but the most exceptional cases, open to the public. The resulting attention holds claimants accountable; for example, one popular music publisher withdrew its application after widespread criticism from customers.180 Asking a court to order disclosure is therefore often the safest course for an internet intermediary that is unsure of the merits of a request or would prefer not to engage in an assessment of those merits at all.

4.136  Obligations of confidence. In some cases, court-ordered disclosure may be necessary because a service provider would otherwise be bound by obligations of confidence which prevent them from disclosing users’ identities. While terms of service can be used to limit or exclude confidentiality, internet intermediaries have little incentive to widen their enforcement obligations and may face criminal liability if they voluntarily disclose telecommunications data.181 The availability of compulsory disclosure is therefore a necessary antidote to the secrecy of communications which intermediaries are increasingly required to protect.

4.137  The flexible calculus of proportionality. Cases such as Media CAT and Golden Eye demonstrate that the concept of proportionality can set meaningful limits on disclosure by requiring courts to assess the relative impact of disclosure upon claimants, internet intermediaries, and their users. Proportionality offers a flexible tool for balancing these parties’ rights. At its simplest, it confirms the intuition that if the wrong is serious and the risk of misidentification low, disclosure is justified. If, however, the wrong is minor and the third parties are only speculative tortfeasors or may suffer serious irreparable harm from being identified, disclosure may be out of proportion to the claimant's objectives. This calculus is an essential part of the exercise of the Court’s discretion because it provides an opportunity to protect and encourage socially beneficial exchanges (and discourage undesirable ones) by ensuring that the uploaders of valuable material are less likely to be unmasked without good reason.

4.138  The problem of incommensurability. Properly applied, proportionality ensures that the privacy of innocent parties is not unnecessarily invaded, and that probable wrongdoers are not intruded upon more than required. However, proportionality is a notoriously difficult test to apply. This is partly because it fails to offer any universal criteria for balancing incommensurable interests. Weighing the relative impact of disclosure on privacy and freedom of expression against the need for a claimant to have access to justice cannot be done sensibly unless those two imperatives share a common unit of measurement.182 The impact which disclosure has on an individual’s right to private life cannot easily be measured—especially if their identity is unknown, since the precise degree of intrusion will depend on both their circumstances and the nature of the activity which the claimant seeks to attribute to them. Doubtless, in some cases there will be a common unit, as where the applicant suffers reputational or economic harm and disclosure would cause the same type of harm to the anonymous party. In many other cases, proportionality will offer an incomplete framework for assessing whether one outcome is preferable to another, which will require courts to develop additional criteria for weighing disclosure against privacy.

4.139 English courts have only partly embraced proportionality as a limitation upon disclosure. As seen in Viagogo, proportionality often folds into an assessment of necessity, in that if disclosure is the only way a claimant can proceed, it tends to be considered proportionate regardless of the other consequences.

4.140 Because Norwich Pharmacal relief, by its nature, tends to be sought in circumstances where there is no other source of the information, necessity fails to supply an independent limiting criterion (indeed, it merely repeats one of the elements for relief) and is conceptually redundant. If it be objected that no limiting criterion is needed, one should recall the potential inconvenience to ‘mere witnesses’ which provided the impetus for limiting equitable disclosure throughout its history. There is no reason to assume that those risks have entirely abated. Besides Golden Eye, very few courts have directly considered the impact of disclosure upon freedom of expression or made more than superficial efforts to balance the parties’ rights. In many cases, courts disregard the rights of internet users entirely. Some possible solutions to these shortcomings are offered in the following sections.

4.141  The current standard. The standard to which claimants must prove wrongdoing has been progressively diminished by cases such as Mohamed and Arab Satellite. While this has the advantages of speed and economy for claimants, it is an imperfect disclosure heuristic which reflects a trade-off in favour of claimants as against publishers of material. More should be done to restrict disclosure to ‘those who can reasonably be assumed to be wrongdoers’.183 This requires consideration of the claimant’s likelihood of success at trial, the availability of defences, and the substantiality of wrongdoing. A lower threshold would make disclosure a cheap, fast remedy for anyone who wished to silence a critical voice on the internet. If claimants could unmask publishers by making allegations that, while arguable, are unlikely to succeed at trial, the mere threat of identification may be sufficient to deter anonymous authorship in ways that deprive the public of access to a much wider class of socially valuable expressions.184

4.142  Criticism. Where the existence of primary wrongdoing is in doubt, achieving justice for both claimants and innocent third parties requires the Court to consider the probability that disclosure will eventuate to be unjustified. For example, given that a relatively small percentage of defamation claims succeed,185 the threshold for disclosure should aim to avoid ‘trivial defamation lawsuits primarily to harass or to unmask’ an anonymous critic.186 The same is true of copyright, which often relies on balancing and impression rather than bright lines of legitimacy.187 Courts must be mindful of the need to avoid presumptively validating marginal claims in a way that compromises freedom of expression and risks turning disclosure into a vehicle for harassment.188

4.143  Reform possibilities. Although a Norwich Pharmacal hearing is not the place for a full trial of the merits, the intrusiveness and potential chilling effects of disclosure justify two further threshold requirements. First, the Court should be satisfied of the primary claim at least to the standard of surviving summary dismissal;189 that is, it must have a real prospect of succeeding.190 A similar uniform standard has been adopted by some United States courts.191

4.144 Second, consistently with section 12(4) of the Human Rights Act 1998, the Court should have regard to the importance of freedom of expression when considering whether to grant relief. Although section 12(3) does not apply (since publication is not directly being restrained),192 it suggests that the claimant’s likelihood of success is a highly relevant factor in making that determination. Raising the threshold for disclosure will not adversely affect claimants because they will not be required to prove anything they would not already be required to prove at trial.193 It merely makes the claimant prove his case ‘at an earlier stage in the proceedings’194—the mirror image of the mere witness rule.

4.145 Self-evidently, primary wrongdoers do not often advertise their identities willingly. To the contrary, many take active steps to conceal them. It is no coincidence that the defamatory comments in Tamiz, Godfrey, and Totalise were made anonymously; and that the file-sharers and tracker operators in iiNet, Newzbin, and Dramatico were anonymous.195 In Viagogo, the Supreme Court emphasised that the marketplace allowed people ‘anonymously to sell event tickets’,196 much as eBay affords partial anonymity during registration.197

4.146  The need for disclosure. Frequently, it is only possible to unmask an internet user by assembling myriad data held about them by ISPs and other internet intermediaries. However, not without justification, most data controllers refuse to reveal their customers’ identities without a valid court order. It is clear that a robust and efficient disclosure procedure is necessary to assist claimants in unravelling the tangled web of identity information contained in IP addresses, usernames, and pseudonymous email accounts scattered among multiple services, each of whom possesses one necessary but insufficient piece of the puzzle.198 Equally, because Norwich Pharmacal orders make it possible to triangulate internet users in precisely this way, care is required to ensure that such an invasive remedy is not misused.

4.147  Relationship between disclosure and secondary liability. The availability of disclosure indirectly reduces pressure on internet intermediaries to provide a substantive remedy by offering up a party who is more closely connected with harm. Without disclosure, relief against the primary tortfeasor would be impossible or impracticable and a deep-pocketed secondary party may be named in their place. In this way, disclosure complements safe harbours and reinforces the limits of secondary liability by improving the likelihood that the primary wrongdoer can be pursued. Disclosure thus preserves the status of many internet intermediaries as innocent facilitators who are ‘mixed up in wrongdoing’ rather than obligated to police or compensate it.

4.148  Excessive cost. Despite its strengths, it is clear that disclosure cannot solve the problems of widespread internet wrongdoing on its own. It can be expensive to obtain, at least in test cases. In Eircom, the Irish High Court commented:

this process is burdensome and, ultimately, futile as a potential solution to the problem of internet piracy. [One witness] has given evidence of the time, trouble and expense involved in the pursuit of this remedy....To identify 17, 49 and 23 names, through the three cases seeking Norwich Pharmacal orders, cost €680,000 to pay solicitors and barristers on all sides. Some settlements were effected, returning €80,000.199

4.149 Existing disclosure procedures ‘are indiscriminate, costly and inefficient’, and take no account of the degree of care exercised by a service provider for the purpose of determining costs.200 One partial solution, discussed in chapter 6, is to disclose anonymised data about infringers to inform a determination of which are worth pursuing.201 However, it will rarely be feasible or palatable for a claimant to take action against every suspected wrongdoer. The costs of pleading and proving each tort would quickly prove crippling to all but the most well-resourced of claimants, and there are obvious reputational costs in having to bring proceedings against consumers, relying upon fallible identity evidence. The damages recoverable will rarely outweigh these costs, particularly where the wrongdoing is small but widely dispersed.

4.150  IP addresses and individuals. Even if evidence pointing towards an email or internet account is possessed, that does not guarantee correct identification of the tortfeasor. While some data uniquely identify a single device to which only one person has access, the vast majority do not. As courts have pointed out in Golden Eye and iiNet, a public IP address is ‘not necessarily’ a specific person or computer and, at most, identifies an account holder.202 Identity data may reveal the holder of a shared subscriber account, an anonymous email address, an IP address which can no longer be matched to a particular subscriber, a shared device in a library, hotel, or workplace, or an unsecured network or public access point which has been used by unknown persons. In some cases, the data may even be deliberately forged.203

4.151  Accuracy of IP address data. Disclosure remedies are accordingly vulnerable to the criticism that they accept the accuracy of IP address data and assume an identity between device and wrongdoer. In some cases, it may be appropriate to require expert evidence to verify the methodology by which putative wrongdoers were located. Even if accurate, courts deciding the primary claim will be required to draw inferences about use of shared user accounts, as in Applause Store.

4.152 Courts should be mindful of these evidentiary limitations and carefully assess, in any given case, the extent of uncertainty associated with evidence linking a particular electronic resource to the defendant. As the identity ‘arms race’ between claimants and anonymous defendants continues to be waged, the sophistication of the available techniques, and their countermeasures, will increase. Australian and Canadian courts have insisted upon detailed examination of the technical evidence and its limitations.204 It is noteworthy that few English decisions have addressed this issue in any detail.

4.153  Traditional approach. The scope of disclosure to which an applicant should be entitled was traditionally limited to what was necessary to establish the intended defendant’s identity. For example, in Norwich Pharmacal, their Lordships were mindful of floodgates arguments and the risk of ‘fishing’ by optimistic claimants who wished to seek out evidence to support a potential claim. Lord Cross dismissed such concerns because disclosure is solely of identity information and not the collection of evidence at large, which it was rightly assumed would be more time-consuming.205

4.154  Modern approach. As noted in paragraph 4.122, modern cases have a tendency to extend disclosure beyond mere identity and into the realm of substantive discovery. This will often be improper. The equitable jurisdiction was never designed to substitute or augment existing procedures for obtaining preliminary or non-party disclosure, but rather as a means of identifying the wrongdoer in order to take further action against them. As Suzor has argued, ‘[i]nformation and identity discovery perform different roles, and should not be confused or granted simultaneously’.206

4.155 There must be a measure of pragmatism about the scope of a disclosure request. For example, to guard against the risk that an account holder’s name has been incorrectly stated in an intermediary’s records, it will often be appropriate to order disclosure of billing information (eg credit card or bank account details) in order to corroborate the core identity information. To the extent that disclosure extends beyond identity information, it is suggested that this should be a matter to be considered in the overall proportionality inquiry.

4.156  Non-identity information. In principle, the scope of disclosure should be limited to specific wrongs and should exclude irrelevant personal information. In particular, it should leave out non-identity evidence which may reveal unrelated characteristics of the intended defendant (eg generalised internet browsing or search history).

4.157  Objections to scope of disclosure. There is an inherent tension between the effectiveness of equitable disclosure from the claimant’s perspective and the need to protect third parties from disproportionate requests. Claimants rightly consider that they should be entitled to obtain all relevant information to support their claim against a wrongdoer. However, while the equitable jurisdiction is clearly flexible and powerful, it lacks an effective procedure by which suspected wrongdoers can object to excessive disclosure, and no party before the Court has adequate incentives to object to irrelevant or privileged material.207 This makes close judicial scrutiny of these applications of particular importance.

4.158  Statutory disclosure. Other forms of disclosure incorporate stronger safeguards for the protection of third parties’ interests.208 Absent exceptional circumstances such as fraud or urgency, those procedures should normally be used to obtain non-identity information if the identity of the potential defendant is already known.

4.159  Public interest anonymity.Another largely unexplored factor is the extent to which a public interest exists in maintaining the freedom to express impugned material privately. It is true that much of the internet’s most offensive and harmful ‘noise’ is published anonymously.209 Some services traffic in anonymous postings, many of them tortious;210 others make attribution mandatory to increase the ‘signal-to-noise’ ratio of valuable content.211 Many anonymous contributions are authored by minors. Their social and literary value varies enormously, but it is safe to say that attribution is more common for high-quality speech. Doubtless, much of the content that is published anonymously online is close to valueless, but other material makes invaluable contributions to intellectual and social life in ways that attributed material may not dare: it exposes wrongdoing,212 holds governments and public authorities to account,213 entertains and informs.214

4.160  Examples of anonymous speech.Faced with a request for disclosure, courts should have regard to the wider public interest in anonymity as part of the proportionality assessment. Many examples can be cited of how anonymity protects speakers and promotes valuable social policies: (1) whistle-blowing by employees or public officials; (2) commentary and satire by prominent members of the public; (3) political polls; (4) teacher evaluations, product and business reviews; (5) public postings by children or vulnerable parties; (6) authors whose safety could be jeopardised by identification; and (7) victims of crime or harassment. As Aldous LJ noted in Totalise, ‘there are many situations in which...the protection of a person’s identity from disclosure may be legitimate’.215 Rights to freedom of expression encompass both the named and the anonymous.

4.161  Anonymity and proportionality. Noticeably absent from Norwich Pharmacal jurisprudence is any consideration of the reasons why alleged tortfeasors might choose to conduct themselves privately. To assert, as Owen J did in Totalise, that when an author chooses to express himself anonymously on a public platform he runs the risk that his identity will be unmasked, ignores those reasons. This is not to say that anonymous speech is always, or even frequently valuable; on the contrary, the ‘shield of anonymity’216 will often assist tortious conduct while making little or no contribution to matters of public interest. However, the potential value of anonymity in a particular case is relevant to determining which set of interests should enjoy priority.

4.162  Circularity of existing approaches.The decisions in Viagogo and Golden Eye assume that privacy rights are not engaged where data identify arguable wrongdoers. This approach suffers from the obvious circularity that data reveal arguable wrongdoing whenever wrongdoing is argued to have occurred, which is tantamount to saying that privacy interests can never trump an allegation of wrongdoing—however tenuous the claim or otherwise strong the expectation of privacy. It is, of course, reasonable to suggest that internet users should not be able to wear the mantle of privacy to conceal actual or suspected invasions of others’ rights. However, even tortfeasors may be entitled to expect privacy in respect of their private information. First, they remain entitled to protection of data which concern unrelated non-tortious activities (such as details of private correspondence or internet activity). Second, even if they have no legitimate interest in obscuring their identities as against a claimant (or a service provider), they might still expect privacy from third parties.

4.163 The Court’s willingness to permit disclosure in Viagogo is better explained in two ways. First, users’ data were collected in the context of ordinary arms-length commercial transactions between buyers and sellers. In other cases, the collection of transaction data may well create a reasonable expectation of privacy: consider the position of consumers who purchase medicaments, legal services, or pornography online. Second, unlike Golden Eye, very few innocent users would be affected, since sellers were invariably in breach of the same ticketing conditions. This is unlike an application for bulk disclosure against an ISP, where a substantial percentage of affected subscribers may not be infringers. Both factors suggest that the approach taken in Viagogo may not be readily adaptable to cases involving greater spillover effects or data sensitivity.

4.164  Platform terms of use.Courts also assume that privacy interests are not engaged in respect of material known to breach a website’s policies or terms of service.217 That is to say, only posters of permitted material may reasonably expect privacy. There are three problems with this approach. The first is that even impermissible material may be legitimate and non-tortious. Users might expect that such material would be deleted, but not that it could justify disclosure to a third party who had no legal rights against its author. Second, courts do not consider whether a website’s terms of use are reasonable. It is conceivable that the restrictions imposed may be so oppressive that they would fail to offer any guidance about what can legitimately be expected.218 Third, it is doubtful whether consulting the terms of use will shed much light on the expectations of users—who rarely read or understand them.219 In practice, most websites adopt terms which permit (and often make discretionary) disclosure of data in extremely broad circumstances. Consumers are rarely in a position to negotiate these terms. The courts’ approach therefore has the unintended effect of encouraging internet intermediaries unilaterally to ‘opt-out’ from privacy protections.

4.165  Graduated or conditional disclosure. In weighing the proportionality of disclosure, one important consideration is whether an alternative procedure is available which poses a less substantial interference. One alternative, modelled on the Digital Economy Act 2010, may be to require a service provider to forward the claimant’s allegations to the primary wrongdoer without disclosing their identity to the claimant. It may be ordered that the claimants could obtain disclosure only where the wrongdoing continues.220 Further action may not be necessary if notices dissuade their recipients to renounce their tortious activity—though empirical evidence is divided on whether notices will have this effect.

4.166 Graduated response of this kind is inappropriate for wrongs which may not occur more than once or require immediate relief, such as defamation or breach of confidence. However, in cases involving repeated or ongoing wrongs of a small scale, notification by the ISP may be a more proportionate response than disclosure, having regard to the relative impact on claimant and intended defendant. If the defendant heeds the notice and ceases wrongdoing, there would be no substantial purpose served by disclosure. If the wrongs continue (or are highly likely to do so), then disclosure may be necessary.

4.167  Copyright infringer lists. For copyright claims, the Digital Economy Act 2010 creates a statutory right to disclosure. However, neither the Act nor the Code specify how applications for disclosure are to be determined: there must simply be ‘an appropriate court order’.221 Leaving aside the nebulous drafting, such an approach poses serious difficulties: the Act makes no provision for dealing with sensitive or personal information revealed on infringer lists; there is nothing to restrict the use of disclosed data or to require that disclosure be sought for a legitimate purpose. These omissions support the view that Parliament must have intended existing equitable principles to limit statutory disclosure. Certainly, the Act does not evidence an intention to make disclosure of unredacted infringer lists automatic—otherwise there would be no need for a court order.

4.168 Where multiple applications for disclosure are made in parallel, or in respect of multiple but related wrongs, it will often be appropriate for the Court to determine how best to manage those proceedings to ensure prompt determination of common issues and minimise overlap between them. The Court’s intervention may reduce the overall cost of proceedings by consolidating disclosure applications and determining contested issues at an early stage. Where thousands of intended defendants are involved, active case management is desirable to prevent disclosure from becoming unmanageable.222

4.169 This section identifies five safeguards which may in certain circumstances be appropriate to protect the rights of third party data subjects where disclosure is ordered against an internet intermediary.

4.170 A data subject who is affected by a disclosure order proposed to be made may, in appropriate cases, be given notice of the application and given an opportunity to make submissions. However, there is no requirement to do so and, in some cases, disclosure may be inappropriate if it would ‘tip off’ a wrongdoer and frustrate the purpose of the order.

4.171  Rationale for giving notice.In Totalise, Aldous LJ identified one of the less attractive features of Norwich Pharmacal relief: proceedings are ex parte as regards the user about whom disclosure is sought and so ‘are not truly ordinary adversarial proceedings’.223 This means that the person most affected by disclosure has no ability to oppose it. In his place stands the service provider, whose professed neutrality makes it a miserly champion—one that desires only to escape the proceedings without excessive damage to balance sheet or reputation. The Court is thus left to determine:

a contest between two parties, neither of whom is the person most concerned, the [third party] data subject; one of whom is the data subject’s prospective antagonist; and the other of whom...would like to get out of the cross-fire as rapidly and as cheaply as possible. However, the website operator can, where appropriate, tell the user what is going on and to offer to pass on in writing to the claimant and the court any worthwhile reason the user wants to put forward for not having his or her identity disclosed. Further, the court could require that to be done before making an order.224

4.172 Although the courts in Totalise, Sheffield, and Golden Eye ultimately did not require notice to be given, a notification requirement has much to commend it. Notice ensures that purported wrongdoers are aware of the allegations being made against them and given an opportunity to respond, or to seek to set aside a disclosure order, before an irreversible step is taken. This may result in the Court uncovering gaps in the evidence or other legitimate reasons why a third party stands to be disproportionately harmed by disclosure. It permits data subjects to contribute usefully to the delicate balancing of interests that is required under articles 8 and 10 of the Convention—an inquiry which, as experience has shown, courts frequently get wrong even with the assistance of both affected parties. Notification may not solve the difficulties inherent in this exercise, but it would bring more of the relevant facts before the Court.

4.173  Practice in other jurisdictions. Notification would mirror accepted practice in other jurisdictions.225 It is also consistent with the obligations of internet intermediaries as data controllers, since under the first data protection principle notice of disclosure should be given to data subjects where practicable.226 It is suggested that taking reasonable steps to notify should, in appropriate cases, be a precondition of relief, unless the claimant can demonstrate good reasons why this would be inappropriate or impracticable.

4.174  Submissions by interveners. Alternatively, there may be good reasons to allow an interested third party to intervene in the application as amicus curiae, as occurred in Golden Eye.227 This allows amici (most commonly consumer and civil liberties groups) to stand in for affected parties to defend substantial or novel claims for disclosure, subject to bearing their own costs. Similar principles have been applied in Anton Piller applications with some success.228

4.175  Risk of prejudice. Notification would be inappropriate if a serious risk of prejudice could be shown by the applicant or if the number of affected parties is so large that individual notification would be unduly costly—though the cost of emailing even large numbers of customers can be overstated. This was the reason given in Golden Eye, along with the unlikelihood that many would respond.229 In Wikimedia, Tugendhat J seemed to reason that some cases may even require ancillary orders to prohibit disclosure of the fact that a Norwich Pharmacal order has been made.230 Such a ‘super-disclosure’ order could only be justified in limited circumstances; for example, to prevent tipping off unidentified wrongdoers, who might take retaliatory steps or erase their tracks by requesting deletion of all personal data held by any downstream service provider who could identify them.231

4.176  Costs of notification. The added expense of notification should, of course, be borne by the party who emerges unsuccessful from the ultimate proceedings. In some cases, notification may reduce litigation costs by ensuring that claimants with unmeritorious claims are not able to pursue them.

4.177 The authorities offer little recourse to parties who are adversely affected by disclosure that was wrongly given. Once disclosed, the secrecy of a party’s identity cannot be restored and even a triumphant defendant may face repercussions from employers, spouses, the press, or the general public—without having committed any actionable wrong. The lack of any mechanism to permit recovery of these losses from the claimant means there are limited disincentives against speculative applications. In appropriate cases, courts should therefore consider requiring the claimant to undertake to compensate the third party data subjects for any damage caused as a result of disclosure that turns out to be unwarranted because the data subject is not a wrongdoer, or if the applicant fails to pursue the claim against them.

4.178 Such an approach has two clear benefits. First, it would deter unmeritorious applications while still protecting the claimant’s interest in borderline cases by allowing disclosure subject to the undertaking. This reflects the accepted approach to interim injunctions. Second, insisting on a cross-undertaking ensures that Norwich Pharmacal orders cannot be abused by litigants to harass or embarrass anonymous internet authors without pursuing the primary claim. A cross-undertaking can, in an appropriate case, operate as a proportionate condition of the Court agreeing to intervene in the status quo and grant injunctive relief in uncertain circumstances.232

4.179 Because service providers tend to take a neutral stance in disclosure applications, the Court must rely on information that is put before it by the applicant to make factual assumptions which may, after full evidence and argument, turn out to be incorrect, or which are never finally determined at trial.233 In ordinary inter partes applications, the Court must be ‘as satisfied as it can be having regard to the limitations which an interlocutory process imposes’ that the claimant has ‘a much better argument than the defendant’.234 However, Norwich Pharmacal hearings more closely resemble ex parte applications, where the risk of unreliable decisions is compounded by the absence of the party most strongly affected.235

4.180  Judicial consideration. It is sometimes argued that claimants should owe a duty of full and frank disclosure, just as applicants owe in ex parte procedures. This would be by analogy with the principles expressed in R v Kensington Income Tax Commissioners; ex parte de Polignac, since disclosure is sought ‘in the absence of the person who will be affected by that which the court is asked to do’.236 This ‘ingenious argument’ was considered but not resolved by Arnold J in Golden Eye,237 since breach of any duty could only be determined once disclosure had already been ordered.238 The difficulty with this reasoning is that, by the time an affected subscriber is in a position to make such an application, the damage will already have been done, since their anonymity cannot be restored. It therefore remains unclear whether a duty to make full and frank disclosure applies to Norwich Pharmacal applications. However, the possibility remains that an affected data subject will be able to apply to set aside an order and prohibit further use or processing of data about him or her under the Data Protection Act 1998.

4.181 Because the applicant is not obliged to commence proceedings and so have the issues finally determined, the Court has limited ability to control use of the information once it has been disclosed. One solution is to require judicial or other independent supervision of the execution of the orders; for example, by appointing a supervising solicitor, by analogy with Anton Piller search orders. A similar suggestion was made by HHJ Birss QC in Media CAT,239 but rejected in Golden Eye. Arnold J concluded that a supervisor would lack binding authority over the third parties and could not function as a useful arbiter of disputes. It would also greatly increase the cost of obtaining disclosure.

4.182  Collateral use. Use of disclosed information should be restricted to the purpose of taking action against the identified parties or ultimate wrongdoer. That is the basis for intruding upon the privacy of the alleged wrongdoer; if it eventuates that no tort has been committed by them or any related party against the applicant, it seems unjustifiable to allow that information to be retained or used for any other purpose. This limitation follows by analogy with the restrictions on information obtained under regular civil disclosure,240 which prohibit use for any ‘collateral or ulterior purpose’.241 Identity disclosure involves the same principle of public policy—namely, that the fruits of a compulsory and intrusive legal procedure should not be given over to the unconditional use of the claimant. This limitation discourages fishing expeditions and ensures respect for the rights of data subjects. Alternatively, disclosed information could be given an ‘expiry date’ by which the applicant must have commenced proceedings (or taken whatever legitimate action was pleaded) or otherwise undertake to destroy it.

4.183  Secure storage. In appropriate cases, the Court should also issue specific directions, such as anonymity orders, limiting how the disclosed data may be accessed and used,242 and requiring the disclosing and receiving parties to encrypt personal data securely. In failing to impose such requirements, courts may be contravening the seventh data protection principle, which requires data controllers to adopt appropriate measures to prevent unlawful processing of personal data. Since a court ordering disclosure of identity data is determining the purposes for which those personal data may be processed, it is at least arguable that the court is a data controller, along with the applicant.

4.184 The consequences of unencrypted disclosure can be serious for internet users. In Media CAT, the original order required password protection of the disclosed data. However, contrary to the order, BT and several other ISPs sent their data in plain text or weakly protected spreadsheets.243 In May 2010 an unsecured email server belonging to the claimants’ solicitors was attacked by vigilante activists.244 Somewhat ironically, the spreadsheets disclosed by the ISPs propagated rapidly on P2P networks and cyberlockers. Many subscribers (even those who had settled claims) were publicly identified. This regrettable coda to the Media CAT saga could have been avoided had data encryption requirements formed a clearer element of the disclosure obligations.

4.185 The costs of Norwich Pharmacal disclosure are a relevant factor to be considered when assessing the proportionality of the order sought by an applicant. The established practice is that the costs of giving disclosure, along with the costs of responding to the application, should be borne wholly by the applicant. Costs are discussed further in chapter 18.245

4.186 In addition to equitable disclosure, in England and Wales the Civil Procedure Rules make provision for pre-action and non-party disclosure against non-wrongdoers. Equivalent rules of court exist in other common law jurisdictions. This framework is broader than Norwich Pharmacal orders, since it extends beyond disclosure of identity information. The statutory framework does not limit the scope of equitable and other forms of disclosure, but instead operates in parallel with the Norwich Pharmacal jurisdiction: rule 31.18. The following sections discuss the requirements and limits of two forms of statutory disclosure which may be useful in disputes involving allegations of internet wrongdoing. The costs of statutory disclosure are discussed in chapter 18.246

4.187 In some cases, the claimant may wish to determine the identity of a primary wrongdoer in parallel with a claim against the service provider. For example, a website operator may have deliberately published confidential material which had been sent to it by a whistleblower whose identity is unknown to the claimant. In these circumstances, Civil Procedure Rules rule 31.16 permits an application to be made for disclosure before proceedings have started.247 This power can be useful where it appears that an internet intermediary is actively involved in wrongdoing and likely to be in possession of information about other wrongdoers.

4.188 The applicant must satisfy the Court of both its jurisdiction and the desirability of pre-action disclosure. Jurisdiction requires three elements to be satisfied. First, both the applicant and the respondent service provider must be likely to be parties to subsequent proceedings. Second, the documents requested must be such that the service provider would have to disclose them in due course once proceedings are commenced. Third, pre-action disclosure must be desirable in order to dispose fairly of the anticipated proceedings, assist resolution of the dispute without proceedings, or to save costs. The nature of the two-stage inquiry was explained by Rix LJ in Black v Sumitomo:

for jurisdictional purposes the court is only permitted to consider the granting of pre-action disclosure where there is a real prospect in principle of such an order being fair to the parties if litigation is commenced, or of assisting the parties to avoid litigation, or of saving costs in any event. If there is such a real prospect, then the court should go on to consider the question of discretion, which has to be considered on all the facts and not merely in principle but in detail.248

4.189 Factors relevant to the exercise of discretion will include: the nature of the injury or loss complained of; the clarity and identification of the issues raised by the complaint; the nature of the documents requested; the relevance of any protocol or pre-action inquiries; and the opportunity which the complainant has to make his case without pre-action disclosure. The applicant will also need to show at least a prima facie claim against the respondent, though the merits of that claim are not examined in detail.249 The applicant will also need to establish that disclosure is proportionate: rule 31.3(2). It is suggested that similar considerations will apply to those examined in Norwich Pharmacal applications.

4.190 Where granted, disclosure is of ‘documents’. This term is defined in rule 31.4 to mean ‘anything in which information of any description is recorded’. That definition clearly encompasses electronic data and records, provided they are stored in some retrievable form. As Practice Direction 31B explains, the definition includes any ‘electronic document’, which would include databases, server logs, back-ups, emails, instant messages, data files, software, and related metadata.250 The only requirement is that the document contain some recorded information, as distinct from being blank or indecipherable. It seems at least arguable that an encrypted file is capable of being a document, since it contains the information even if that information cannot be viewed until the encryption key has been broken.

4.191 Rule 31.17 permits an application to be made to the Court for disclosure by a person who is not a party to existing proceedings. The documents being sought must be relevant to the claim (in the sense of being likely to support or adversely affect one of the parties’ cases) and necessary either (1) to dispose fairly of the claim, or (2) to save costs.251 These requirements are mandatory: the court may ‘only’ make an order for non-party disclosure where they are satisfied: rule 31.17(3). However, disclosure is discretionary: the court retains a discretion to refuse disclosure even when it is necessary and otherwise meets the requirements.

4.192 In determining whether disclosure is necessary, similar considerations will arise to those examined in section 1.5 in relation to Norwich Pharmacal orders. In particular, it will be important to consider whether there is another practicable source of the documents, and whether the benefit likely to be obtained from disclosure would exceed the cost of giving it. Public policy considerations will also be relevant, including the interests of data subjects whose rights to data protection would be engaged by disclosure to the applicant. Before ordering disclosure, the Court must also be satisfied that the relevant documents exist.252

4.193 This form of disclosure can be useful where proceedings are commenced against an alleged primary wrongdoer, but further information is needed from an intermediary to substantiate claims of wrongdoing. For example, the defendant may be thought to have published material to a known platform or host, but it may not be known whether the defendant was personally responsible for creating or uploading the material. A third party service provider may be able to assist the claimant’s case by supplying details of access logs, IP addresses, or other secondary evidence which can be used to support an inference that it was the defendant who carried out the relevant tortious acts.

4.194 The documents being sought from the internet intermediary must be specified with precision. Evidence should be adduced which shows that (1) the service provider is likely to have control of those documents, and (2) the documents are likely to be relevant, in the sense mentioned. These requests will be carefully scrutinised by the Court, even where the respondent consents to provide the documents:

The court has a clear obligation to ensure, if necessary of its own motion, that this intrusive jurisdiction is not used inappropriately even by consent. In exercising its responsibility, the court may well be assisted by submissions made on behalf of any third party the protection of whose interests requires to be considered.253

4.195 Consistent with this scrutiny, non-party disclosure is said to be ‘the exception rather than the rule’.254 Courts will approach rule 31.17 as a jurisdiction to be ‘exercised with some caution’ and consider the requirements separately in relation to each of the documents and classes of documents of which disclosure is sought. The evidence must be sufficient to allow the Court to consider the necessity of disclosure for the fair disposal of the claim.255

4.196 Where a court makes an order for disclosure of a class of documents under rule 31.17, it should not be necessary for the non-party to determine whether or not documents are relevant. This reflects the impracticability and burden of doing so without access to the pleadings or other evidence in the case. Although it is possible, in principle, to seek disclosure by reference to a class or general description of documents, this must be done carefully. If a class is specified too widely, such that it cannot be said with certainty that all documents falling within it are all likely to be relevant to a party’s claim, then no order will be made in relation to it.256

Notes
1

See, eg, Google Inc, ‘Transparency Report—Requests for User Information’ (1 November 2014). <http://www.google.com/transparencyreport/userdatarequests>.

2

[1974] AC 133 (‘Norwich Pharmacal’).

3

Norwich Pharmacal, 175 (Lord Reid).

4

Norwich Pharmacal, 204 (Lord Kilbrandon).

5

Cf Pressed Steel Car Co v Union Pacific Railway Co 240 F 135, 136 (DC, 1917) (Judge Learned Hand); Post v Toledo, Cincinnati and St Louis Railroad Co 11 NE Rep 540, 547 (Ma SC, 1887).

6

Norwich Pharmacal, 179 (Lord Morris).

7

Norwich Pharmacal, 145–6 (Buckley LJ).

8

See Morton Norwich Products v Intercen [1978] RPC 501.

9

British Steel Corporation v Granada Television Ltd [1981] AC 1096, 1114 (Megarry VC).

10

Norwich Pharmacal, 145 (Buckley LJ).

11

One in a Million, 920 (Aldous LJ) (passing off). See also Microsoft Corporation v Ling [2006] EWHC 1619 (Ch), [36] (HHJ Havery QC).

12

Ashworth, 2039 (Lord Woolf CJ) (Lord Slynn agreeing). See also British Steel, 1104 (Megarry VC).

13

Shlaimoun v Mining Technologies International Inc [2011] EWHC 3278 (QB), [24] (Coulson J).

14

Lockton Companies International v Persons Unknown [2009] EWHC 3423 (QB), [4] (Eady J).

15

British Steel Corporation v Granada Television Ltd [1981] AC 1096, 1114 (Megarry VC).

16

[1981] AC 1096, 1114 (Megarry VC) (‘British Steel’).

17

Interbrew SA v Financial Times Ltd [2002] EMLR 24, 457, 460 (Sedley LJ) (‘Interbrew’).

18

Norwich Pharmacal, 185 (Viscount Dilhorne). See, eg, Plummer v May (1750) 1 Ves Sen 426, 426; 27 ER 1121, 1122 (Lord Hardwicke LC).

19

See Evidence Amendment Act 1851 (14 & 15 Vict c 99); Common Law Procedure Act 1852 (Imp).

20

Doubtless the rule also served other purposes; it protected persons with an insufficient interest in the proceeding from being named as parties by providing grounds for a demurrer: John Mitford, Mitford’s Pleading (4th ed, 1827) 191. It also restricted the collateral purpose of using bills of discovery to delay a parallel common law action: see Norwich Pharmacal, 192 (Lord Cross); Hunt v Maniere (1864) 34 Beav 157; 55 ER 594.

21

Norwich Pharmacal, 174 (Lord Reid).

22

Dixon v Enoch (1872) LR 13 Eq 394, 400 (Wickens VC) (emphasis added).

23

Charles Hollander, ‘Norwich Pharmacal Takes Wings’ (2009) 28 Civil Justice Quarterly 458, 464.

24

Norwich Pharmacal, 139 (Lord Denning MR), 197 (Lord Cross).

25

(1876) LR 4 Ch D 92, 95 (Hall VC). See also Norwich Pharmacal, 181 (Lord Morris).

26

See, eg, Upmann v Elkan (1871) LR 12 Eq 140, 145–6 (Lord Romilly MR); Upmann v Forester (1883) 24 Ch D 231, 235 (Chitty J). The Lord Chancellor remarked of intermediary immunity that ‘I cannot conceive a doctrine more dangerous or mischievous...with respect to trademarks’: at 132 (Lord Hatherley LC).

27

Norwich Pharmacal, 202–3 (Lord Kilbrandon).

28

Norwich Pharmacal, 174 (Lord Reid).

29

[2002] 1 WLR 2033, 2039 (‘Ashworth’).

30

Norwich Pharmacal, 176 (Lord Reid), 182 (Lord Morris), 190 (Viscount Dilhorne), 199 (Lord Cross), 206 (Lord Kilbrandon).

31

Customs and Excise Commissioners v Barclays Bank plc [2007] 1 AC 181, 194 (Lord Bingham) (‘Barclays Bank’).

32

See Mareva Compania Naviera SA v International Bulkcarriers SA [1975] 2 Lloyd’s Rep 50 (‘Mareva’); Civil Procedure Rules r 25.1(1)(f).

33

Barclays Bank, 194 (Lord Bingham); Searose, 895 (Robert Goff J).

34

Barclays Bank, 191 (Lord Bingham). See also Barclays Bank, 221 (Lord Mance).

35

Ashworth, 2048 (Lord Woolf CJ) (Lord Slynn agreeing).

36

See Attorney General v Times Newspapers Ltd [1992] 1 AC 191.

37

See Attorney General v Punch Ltd [2003] 1 AC 1046; Z Ltd v A-Z and AA-LL [1982] QB 558, 578 (Eveleigh LJ).

38

The circumstances in which breach of an order will lead to criminal liability are beyond the scope of this work, but see Attorney General v Times Newspapers Ltd [1992] 1 AC 191, 217 (Lord Oliver).

39

Orr v Diaper (1876) LR 4 Ch D 92, 96 (Hall VC); 25 WR 23.

40

Norwich Pharmacal, 179 (Lord Morris).

41

British Steel, 1132 (Templeman LJ).

42

Interbrew, 460 (Sedley LJ).

43

Norwich Pharmacal, 147 (Roskill LJ). See also British Steel, 1141 (Watkins LJ); R (on the application of Revenue and Customs Commissioners) v W [2008] EWHC 2780 (Admin), [38]–[39] (Ouseley J).

44

See, eg, Contempt of Court Act 1981 (UK) s 10.

45

Viagogo (SC), 3338 (Lord Kerr JSC).

46

Colonial Government v Tatham (1902) 23 Natal LR 153, 158 (Beaumont AJ); Harrington v Polytechnic of North London [1984] 1 WLR 1293, 1299 (Sir John Donaldson MR); Mitsui, [24].

47

See Mersey Care NHS Trust v Ackroyd [2006] EMLR 12, 318 (Tugendhat J); Ashworth, 2051 (Lord Woolf CJ) (Lord Slynn agreeing).

48

Norwich Pharmacal, 175 (Lord Reid).

49

Bankers Trust Co v Shapira [1980] 1 WLR 1274, 1282 (Lord Denning MR).

50

Jade Engineering (Coventry) Ltd v Antiference Window Systems Ltd [1996] FSR 461, 466 (Jacob J) (‘Jade Engineering’).

51

See chapter 5, paragraphs 5.47 to 5.53.

52

Norwich Pharmacal, 165 (Peter Oliver QC, in argument).

53

Norwich Pharmacal, 203 (Lord Kilbrandon).

54

Norwich Pharmacal, 142 (Buckley LJ).

55

See chapter 18, section 2.2.

56

Ashworth, 2049 (Lord Woolf CJ) (Lord Slynn and Lord Browne-Wilkinson agreeing).

57

Mitsui & Co Ltd v Nexen Petroleum UK Ltd [2005] EWHC 625 (Ch), [20] (Lightman J) (‘Mitsui’).

58

Hollander, n 23, 466.

59

Paul Cox, ‘Evolution or Revolution? Norwich Pharmacal Orders over the Last 20 Years’ (2004) 172 Trademark World 40, 40.

60

Norwich Pharmacal, 178 (Lord Morris) (emphasis added).

61

R (on the application of Mohamed) v Secretary of State for Foreign and Commonwealth Affairs [2009] 1 WLR 2579, 2607 (Thomas LJ) (‘Mohamed’).

62

See, eg, P v T Ltd [1997] 1 WLR 1309 (‘P v T’) (though the order was in reality preliminary disclosure for the purpose of evaluating a potential claim against an identified tortfeasor).

63

Arab Satellite Communications Organisation v Al Faqih [2008] EWHC 2568 (QB), [25].

64

Ashworth, 2035 (Lord Slynn) (breach of contract). See also Interbrew, 457 (Sedley LJ).

65

See P v T (defamation); RCA Corporation v Reddingtons Rare Records [1974] 1 WLR 1445, 1446–7 (Goff J) (copyright).

66

See Warner-Lambert Company LLC v National Health Service Commissioning Board [2015] EWHC 485 (Pat).

67

See Generics (UK) Ltd (t/a Mylan) v Warner-Lambert Company LLC [2015] EWHC 2548 (Pat).

68

Norwich Pharmacal, 188 (Lord Cross).

69

Ashworth, 2042 (Lord Woolf CJ) (Lord Slynn agreeing).

70

Ashworth, 2041 (Lord Woolf CJ) (Lord Slynn agreeing). This reflects the preferred formulation of Viscount Dilhorne in Norwich Pharmacal, 188.

71

Norwich Pharmacal, 178 (Lord Morris).

72

Aamer v The Secretary of State for Foreign and Commonwealth Affairs [2009] EWHC 3316 (Admin), [43].