Global Processing Services (UK) Limited v Vladimir Yanpolsky & Anor.

For summary judgment in a breach of confidence claim, the court asks whether the defendant has a real prospect of successfully defending the claim. Used material disclosed by the prosecution in criminal proceedings is not protected by the statutory regime for unused material under section 17 of the Criminal Procedure and Investigations Act 1996. Whether common law imposes an implied undertaking concerning used material remained unsettled, and a first-instance court was bound by Mahon v Rahn on that issue. That did not prevent a separate claim in breach of confidence. The usual elements are confidential information, circumstances importing an obligation of confidence, and unauthorised use to detriment. A public-interest exception is assessed objectively; good faith alone is insufficient. A threatened disclosure to individual data subjects, which was neither limited nor proportionate, could not realistically fall within that exception or the purpose of a proposed criminal appeal.

The claimant, a payment-processing technology provider, sought summary judgment and an injunction against its former chief technical officer and his wife. The defendants had received extensive computer-system data as an exhibit served by the prosecution in the first defendant’s criminal proceedings. They later sent, or threatened to send, emails containing or referring to cardholder and payment information to regulators, payment organisations, media organisations and the claimant’s customers.

The parties disputed whether the data retained the necessary quality of confidence, whether it was imparted in circumstances importing an obligation of confidence, whether an implied undertaking restricted use of used prosecution material, and whether the defendants’ actual or threatened use was protected by purposes or public-interest exceptions. The issue under CPR 24.2 was whether the defendants had a real prospect of successfully defending the claim.

1. Summary judgment and relief. The claimant obtained summary judgment in respect of the threatened misuse of the disclosed data. An injunction was granted in the terms sought. The defendants’ conduct and the evidence disclosed no realistic prospect of a successful defence.
2. Implied undertaking. Section 17 of the Criminal Procedure and Investigations Act 1996 applied only to unused material and did not apply to the exhibit, which was used material. Mahon v Rahn held at common law that no implied undertaking arose on disclosure of used material. Taylor v Director of the Serious Fraud Office displaced that decision for unused material, but left the used-material issue open. Although there were strong arguments for recognising an undertaking, the judge was bound by Mahon v Rahn and would not depart from it on this application. The point did not defeat the claim because the claimant sued in breach of confidence.
3. Breach of confidence. Applying the formulation in Coco v A.N. Clark (Engineers) Ltd, the information had the necessary quality of confidence, was imparted in circumstances importing an obligation of confidence, and had been used or threatened to be used without authorisation to the claimant’s detriment. The defendants’ own descriptions of the data as private, sensitive and information a hacker might seek made a successful trial defence on the first two elements unrealistic. Evidence that some card accounts were aged or described as dead did not establish that the data as a whole lacked confidentiality.
4. Exceptions. The defendants’ subjective good faith did not determine whether the public-interest exception applied. The scope of the use was relevant, but the threatened contact with individual cardholders was plainly neither limited nor proportionate and was not in the public interest. The court did not need finally to decide whether the purposes exception required an objective or subjective test. In any event, contacting cardholders to tell them of an alleged breach was not done for, or with a view to, a proposed appeal. The threatened use was therefore unauthorised.
5. Detriment and remedy. The court did not resolve whether detriment was always required, because the threatened communications would damage the claimant’s reputation. An injunction remained appropriate despite delivery-up steps and cessation of the continuing threat, since the proceedings had been necessary to prevent the threatened conduct and full compliance with earlier orders could not be assumed.