The Rugby Football Union v Consolidated Information Services Limited (Formerly Viagogo Limited) (In Liquidation)

A Norwich Pharmacal disclosure order must be a necessary and proportionate response to the circumstances. The court must balance the applicant’s interest in obtaining redress against the affected individuals’ privacy and personal-data rights. No right has automatic precedence.

The assessment is not confined to the value of identifying each individual transaction. The court may consider the applicant’s wider legitimate objectives, including deterring similar wrongdoing. Nevertheless, the circumstances of each person whose data would be disclosed require close consideration and may exceptionally outweigh the applicant’s interests, even where no feasible alternative source exists. There is no presumption that arguable wrongdoing and the absence of another source will invariably justify disclosure.

The respondent, the Rugby Football Union, controlled the issue of tickets for matches at Twickenham and prohibited resale above face value. The appellant, formerly Viagogo Limited, operated a website through which anonymous users advertised and sold such tickets. The respondent sought the users’ identities so that it could obtain redress for arguable breaches of contract, conversion and trespass.

Tugendhat J granted a Norwich Pharmacal order: [2011] EWHC 764 (QB). The Court of Appeal dismissed the appellant’s appeal: [2011] EWCA Civ 1585. Before the Supreme Court, the appellant relied exclusively on article 8 of the Charter of Fundamental Rights of the European Union. The central issue was whether proportionality had to be assessed solely by comparing the value of identifying each particular transaction with the individual data subject’s rights, or whether the respondent’s wider objectives could also be considered.

1. Appeal dismissed unanimously. Lord Kerr delivered the judgment, with which Lord Phillips, Lady Hale, Lord Clarke and Lord Reed agreed. Disclosure was the only possible outcome of the proportionality assessment on the facts.

2. A Norwich Pharmacal order is a flexible and discretionary remedy whose essential purpose is to do justice. It must be a necessary and proportionate response to all the circumstances. Necessity does not make the remedy one of last resort. Relevant considerations include the strength of the arguable claim, vindication of legal rights, deterrence, alternative sources, the respondent’s involvement, possible harm to innocent persons, confidentiality, privacy and data-protection rights, and journalistic-source protection. The principles derived from Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133 and Ashworth Hospital Authority v MGN Ltd [2002] 1 WLR 2033 were applied.

3. The Data Protection Act 1998 implemented Directive 95/46/EC and permitted disclosure required by a court order or necessary for establishing or exercising legal rights. Before ordering disclosure under section 35(1), however, a court had to balance the right to protection of personal data. Under articles 8 and 52(1) of the Charter, limitations had to be lawful, necessary and proportionate, and had genuinely to protect the rights and freedoms of others. The fair-balancing approach in Productores de Musica de Espana (Promusicae) v Telefonica de Espana SAU [2008] 2 C.M.L.R. 465 was applied.

4. The assessment was not confined to the benefit obtainable from identifying each individual transaction. The respondent’s wider aim of enforcing its ticketing rules and deterring future inflated resale was legitimately relevant. References in Bonnier Audio AB v Perfect Communication Sweden AB to the facts of each case did not require the facts to be isolated from their wider impact. The test in Goldeneye (International) Ltd v Telefonica UK Ltd [2012] EWHC 723 (Ch) was accepted and applied, although that case’s risk of embarrassment and pressure upon innocent internet customers distinguished it from the present circumstances.

5. The Court of Appeal had somewhat overstated matters by saying that disclosure would generally be proportionate whenever arguable wrongdoing and the absence of another means of identification were established. Each affected person’s circumstances always required close consideration and could, in limited cases, displace the applicant’s interests. Here, disclosure merely identified persons apparently involved in transactions contrary to clear ticket conditions, while serving legitimate enforcement and deterrent objectives.

   In incidental alternative reasoning, the court rejected the respondent’s reliance on consent. Acceptance of the website privacy policy amounted, at most, to consent to disclosure when disclosure was proportionate. Consent could not validate a disproportionate court order.

1. United Kingdom Supreme Court: The appeal was dismissed unanimously: [2012] UKSC 55.
2. Court of Appeal: The appellant’s appeal was dismissed. The court upheld the Norwich Pharmacal order and held that the interference with personal-data rights was proportionate: [2011] EWCA Civ 1585.
3. High Court: Tugendhat J granted the respondent a Norwich Pharmacal order after finding arguable wrongdoing, necessity and an appropriate basis for exercising the discretion: [2011] EWHC 764 (QB).