MKR v Cloudflare Limited & Ors

Norwich Pharmacal relief requires a good arguable case of a legally recognised wrong, a respondent sufficiently mixed up in it, a respondent able or likely to provide information identifying the wrongdoer, and disclosure that is necessary and proportionate. The first three requirements are threshold hurdles, and the jurisdiction does not permit a fishing exercise.

A domain registrar or hosting provider may be mixed up in wrongdoing where the wrongful website itself depends on its services. An applicant need not prove the underlying wrong conclusively. Online publication may support arguable harassment and defamation where a person’s name is juxtaposed with adult content. The court may order focused disclosure, dispense with a cross-undertaking in damages, and cap compliance costs.

MKR, an academic, sought Norwich Pharmacal disclosure identifying the person or persons responsible for internet domains that embedded her name in URLs or search snippets leading to adult content. The claim concerned nine domains and was brought against a registrar, related companies, a hosting provider and Cloudflare Limited.

At the hearing, factual disputes about whether Cloudflare Limited controlled or possessed the requested information led to the claim against that defendant being transferred from Part 8 to Part 7 for trial. The court therefore determined only the claims against the second, third and fourth defendants, who did not attend. The central issues were whether MKR had a good arguable case of harassment or defamation, whether the defendants were mixed up in the wrongdoing and could provide the information, and whether disclosure was necessary and proportionate.

Disposition. The claim against the second, third and fourth defendants was allowed. They were ordered to disclose, within seven days, carefully defined information identifying the person or persons behind the relevant domain. MKR was required to pay their compliance costs, capped at £200 per defendant. The claim against Cloudflare Limited was transferred to Part 7 and was not decided.

1. Framework. The Norwich Pharmacal jurisdiction permits a person innocently caught up in wrongdoing, but more than a mere witness, to be required to identify the wrongdoer: Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133. The four conditions are a good arguable case of a legally recognised wrong, involvement in or facilitation of it, ability or likely ability to provide necessary information, and overall justice. The first three are threshold hurdles. The applicant bears the burden throughout, and the jurisdiction does not permit fishing or wide-ranging evidence gathering: Collier v Bennett [2020] EWHC 1884 (QB); Stanford Asset Holdings Ltd v AfrAsia Bank Ltd [2023] UKPC 35; Mircom International Content Management & Consultancy Ltd v Virgin Media Ltd [2019] EWHC 1827 (Ch); Ramilos Trading Ltd v Buyanovsky [2016] EWHC 3175 (Comm).
2. Arguable wrong. It was sufficient to show an arguable crime, tort, breach of contract, equitable wrong or contempt, rather than prove the wrong conclusively: Orb A.R.L v Fiddler [2016] EWHC 361 (Comm). The repeated, targeted conduct gave MKR a good arguable case of harassment under the Protection from Harassment Act 1997, applying the elements identified in Dowson v Chief Constable of Northumbria [2010] EWHC 2612 (QB). She also had a good arguable case of defamation. The juxtaposition of her name with adult content could convey a defamatory implication, applying Monson v Tussauds Ltd [1894] 1 QB 671 and Youssoupoff v Metro-Goldwyn-Mayer Pictures Ltd (1934) 50 TLR 581.
3. Mixed up and possession. A respondent must participate in or facilitate the identified wrongdoing; merely holding evidence is insufficient, although the involvement requirement is significant rather than stringent. The wrongdoing must first be identified with care: Ashworth Hospital Authority v MGN Ltd [2002] UKHL 29; NML Capital Ltd v Chapman Freeborn Holdings Ltd [2013] EWCA Civ 589. The mere-witness cases concerning a telephone company and an ancillary Gmail account were distinguishable. Here, the website itself was the alleged wrong, and domain registration and hosting enabled and facilitated it. The registrar, sister company and parent company therefore satisfied the Mixed Up In Condition. The information sought was likely to exist and to be obtainable by the defendants.
4. Overall justice. Necessity and proportionality did not require the application to be a last resort: Burford Capital Ltd v London Stock Exchange Group plc [2021] 2 All ER (Comm) 377. The relevant factors included utility, alternative sources, privacy, scope and cost, and were fact-specific and non-exhaustive: Rugby Football Union v Consolidated Information Services Ltd [2012] UKSC 55. MKR had tried other routes, no alternative source was apparent, the order was focused, and the balance between anonymity and legal redress favoured disclosure. The Overall Justice Condition was satisfied.
5. Terms and costs. The order contained a collateral-use undertaking. Given MKR’s financial circumstances and the straightforward nature of compliance, no cross-undertaking in damages was required. The ordinary costs rule was applied: the applicant pays reasonable compliance costs, and unsuccessful opposition alone does not displace that protection: Filatona Trading Ltd v Quinn Emanuel Urquhart & Sullivan UK LLP [2024] EWHC 2751 (Comm); Jofa Ltd v Benherst Finance Ltd [2019] EWCA Civ 899.

not stated in the judgment.