Smith v ADVFN Plc

A Norwich Pharmacal application requires proof of actual or arguable wrongdoing, the need for disclosure to enable proceedings against the ultimate wrongdoer, and the respondent’s involvement together with possession, or likely possession, of the necessary information. The court must then exercise a separate discretion. It must consider the burden and expense of disclosure, the scope of the request, data-protection rights, contractual expectations of anonymity and the Article 10 rights of affected persons. An interlocutory application should not become a technical trial about the respondent’s computer systems. Relief may be confined to a manageable and properly established group of postings, with reasonable compliance costs payable by the applicant.

The claimant, who coordinated a shareholders’ action group, sought further disclosure from the operator of an online financial bulletin board. Earlier orders had required disclosure of registered details for 23 anonymous users connected with allegedly defamatory postings. The claimant contended that the respondent had complied too narrowly and sought the IP addresses associated with particular postings, under two alternative draft orders covering either 252 or 100 postings.

The respondent disputed the burden and technical feasibility of extracting the information. The central issues were whether the Norwich Pharmacal conditions were met, how far the court should investigate allegedly defamatory postings on an interlocutory application, and how the court should exercise its discretion in light of privacy, data protection and freedom of expression concerns.

1. Earlier order. The word “registered” governed each of “name”, “address”, “e-mail address” and “IP address”. The respondent had therefore complied with the earlier order by providing the IP addresses recorded on registration.
2. Norwich Pharmacal conditions. The court adopted the three conditions identified in Mitsui Ltd v Lexon Petroleum UK Ltd [2005] EWHC 625 Ch: an actual or arguable wrong by an ultimate wrongdoer; the need for disclosure to enable proceedings against that wrongdoer; and the respondent’s involvement in the wrongdoing, with the ability or likely ability to provide the necessary information. The first condition presented difficulty for the wider request. For the 100 postings already covered by the earlier order, it was appropriate to proceed on the basis that arguable wrongdoing had been established.
3. Nature of the application. The court declined to turn the interlocutory application into a technical trial. It was inappropriate to permit impromptu cross-examination of the respondent’s chief executive or adjourn for competing expert evidence about the database and the extraction process. The approach adopted in Sheffield Wednesday Football Club Ltd v Hargreaves [2007] EWHC 2375 QB, involving detailed assessment of postings, was unsuitable for the wider and more complex application.
4. Discretion. A separate discretionary assessment was required. The Data Protection Act 1998 was engaged. Disclosure required a court order because of data subjects’ statutory rights and their contractual expectation of anonymity. The court also had to take account of the unrepresented users’ Article 10 rights and the invasive nature of the relief.
5. Relief. Option 1 cast the net too widely and was refused. Option 2 was granted for the 100 postings previously within the scope of the order. The respondent was to provide the requested information within seven working days, subject to liberty to apply for more time. The additional information concerning multiple IP addresses was retained, and the claimant was to pay the respondent’s reasonable costs of compliance. The court rejected the contention that the respondent had breached the earlier order.

First-instance interlocutory decision in the High Court. The judgment records earlier disclosure orders made by His Honour Judge Hickinbottom and Gray J, but no appellate decision.