Author: Sophia Purkis
This article was first published by New Law Journal on 14 December 2012, and is reproduced by kind permission.
Case law shows that anonymous internet users have no hiding place, says Sophia Purkis.
The growth of business conducted electronically has provided those with an eye to innovative commercial development with enormous opportunities. It has also created new challenges for those involved in the prosecution of civil wrongs. The courts have recently re-affirmed that they are not fazed by these developments and are applying established rules to meet more novel circumstances, including to identify those who (whether deliberately or not) are conferred anonymity by their use of the internet.
Norwich Pharmacal orders
Recently, the grant of a Norwich Pharmacal order came under close examination by the Supreme Court in The Rugby Football Union v Consolidated Information Services Limited (formerly Viagogo Limited) (In Liquidation)  UKSC 55,  All ER (D) 236 (Nov), which considered the facts of the case and balanced case law against the right to protection of personal data guaranteed by Art 8 of the European Charter of Fundamental Rights. The decision provides a useful summary of the principles upon which a Norwich Pharmacal order will be granted and is an example of how the Courts will apply European and national law to claims involving electronic media.
The application concerned the order obtained by the RFU requiring Viagogo to disclose the identity of those who had used its website to sell and buy tickets above face value for international and national games at Twickenham. The RFU has sole responsibility for issuing tickets and a deliberate policy to allocate them to promote and develop rugby. It therefore has strict rules regarding ticket distribution and its terms and conditions include that any resale or advertisement for such resale at above face value will constitute a breach of contract and render the ticket null and void.
Viagogo appealed the order and the Court of Appeal’s refusal of its appeal. The Supreme Court considered whether the grant of the order breached Art 8 of the European Charter.
In the lead judgment, Lord Kerr summarised the established principles upon which an order could be made to be a “necessary and proportionate response to all the circumstances” and to do justice. The factors to be considered include:
“(i) the strength of the claimant’s proposed claim;
(ii) the strong public interest in allowing an applicant to vindicate his legal rights;
(iii) whether the making of the order will deter similar wrongdoing;
(iv) whether the information could be obtained from another source;
(v) whether the respondent to the application knew or ought to have known that he was facilitating arguable wrongdoing;
(vi) whether the order might reveal the names of innocent persons as well as wrongdoers, and, if so, whether such innocent persons will suffer any harm as a result;
(vii) the degree of confidentiality of the information sought;
(viii) the privacy rights under Art 8 of the European Convention;
(ix) the rights and freedoms under the EU data protection regime of the individual whose identity is to be disclosed.”
He then considered the applicable European law beginning with Directive 95/46/EC, the key instrument of the EU data protection regime, which imposes obligations upon member states to adopt legislation to process and protect personal data but allows such legislation to restrict the scope of those obligations to safeguard and protect the rights and freedoms of others. The Data Protection Act 1998 was implemented in the UK pursuant to the Directive and provides exemptions from the non-disclosure provisions for the purpose of or in connection with legal (and prospective legal) proceedings or to obtain legal advice.
Having reviewed the European Charter and the lower court’s decision in Goldeneye (International) Ltd v Telefonica Ltd  EWHC 723 (Ch),  All ER (D) 79 (Jul), his lordship concluded that many of the established principles for the grant of a Norwich Pharmacal order were relevant to the assessment of whether disclosure was proportionate under Art 8; the court’s duty was to weigh the benefit of the information being sought by the RFU against the effect the disclosure was likely to have on the individual(s) concerned. While there might be instances where the interests of the person whose data was sought might displace those of the applicant, this was not such a case. The appeal was dismissed and order upheld.
The case, like that of Patel v Unite  EWHC 92 (QB),  All ER (D) 155 (Jan), shows that while the use of electronic media might afford individuals anonymity it does not prevent their being pursued for civil wrongs. Those who seek to protect their data and that anonymity through data protection or European legislation must pay heed to case law, as the court will not shy away from applying it even to novel circumstances.
Sophia Purkis, Partner, Fladgate LLP (firstname.lastname@example.org)