Totalise PLC v The Motley Fool Ltd & another
The Claimant was an ISP. The first Defendant operated a website which contained discussion boards, where members of the public could post material.
An anonymous contributor styling himself Z Dust made numerous postings about the Claimant on the Defendant’s bulletin board. On 29 August 2000, the Claimant’s solicitors wrote to the Defendant complaining that such materials were defamatory and asked for their immediate removal. They also observed that Z Dust was in breach of the Defendant’s terms for admission to the site by not identifying himself. The Defendant emailed back on the same day to say that the postings had been removed and Z Dust’s right of access had been revoked.
Z Dust seemed to complain about being excluded, and was readmitted. More postings about the Claimant followed, but on 10 September Z Dust was permanently barred from the site. The Claimant in correspondence asked for the identity of Z Dust but the Defendant refused, relying on the Data Protection Act 1998.
In January 2001, the Claimant discovered that Z Dust was now using the second Defendant’s website for publishing more defamatory statements about the Claimant. By 6 February, there were some 90 messages posted by Z Dust on the second Defendant’s site. The Claimant also asked in correspondence for removal of the defamatory material, removal of Z Dust’s posting rights and disclosure of the identity of Z Dust. The second Defendant also refused to disclose Z Dust’s identity, relying again on the Data Protection Act 1998.
The Claimant sought in the action disclosure of the identity of Z Dust or of any material that could lead to the identification of Z Dust.
The Defendants accepted that there was jurisdiction to grant the relief sought by the Claimants (disclosure of information prior to the commencement of an action and from a party who is not the “wrongdoer”) under the principles set out by the House of Lords in Norwich Pharmacal [1974] AC 133. They questioned whether it was appropriate to exercise that jurisdiction in this case.
The Defendants argued, firstly, that the discretion should not be exercised unless the party seeking disclosure intended to take proceedings against the wrongdoer. In fact the Claimant said that it needed the wrongdoer’s identity so as to take legal advice and decide what to do. The Defendants characterised this as no more than a fishing expedition. The judge dismissed this argument: the Claimant was not seeking to discover whether a tort had been committed, it wanted to know the identity of the tortfeasor, Z Dust. It could then consider how best to protect its legal rights – this might or might not include legal proceedings.
Secondly, the Defendants argued that the exercise of the Court’s discretion should not interfere with the Defendants’ duties under the Data Protection Act 1998. The Claimant relied on section 35 of that Act, which provides:
“(1) Personal data are exempt from the non-disclosure provisions where the disclosure is required by or under any enactment by any rule of law or by order of a court;
(2) Personal data are exempt from the non-disclosure provisions where the disclosure is necessary:
(a) for the purpose of or in connection with any legal proceedings including prospective legal proceedings, or
(b) for the purpose of obtaining legal advice or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”
The judge held that this preserved the Norwich Pharmacal principles.
Thirdly, the Defendants relied on section 10 of the Contempt of Court Act 1981. This provides:
“No court may require a person to disclose nor is any person guilty of contempt of court for refusing to disclose the source of information contained in a publication for which he is responsible, unless it be established to the satisfaction of the court that disclosure is necessary in the interests of justice or national security or for the prevention of disorder or crime.”
The judge held that this did not apply, as it was primarily concerned with the situation of a journalist and what he publishes – material for which he is responsible, unlike the Defendants running a bulletin board service.
On the facts, the judge had no hesitation in finding that the balance weighed heavily in favour of granting the relief sought.
This case and the following one, Sir Elton John and Others v Countess Joulebine and Others, raise a number of important issues for ISPs and is of particular relevance to ISPs who provide bulletin board facilities. The cases add to the decision in Godfrey v Demon Internet Ltd ([1999] Masons CLR 267). In that case the claimant advised the defendant that certain postings (which appeared to be made by Godfrey himself but which were in fact forged) were defamatory and demanded their removal. The defendant did not take immediate action and was held liable for publication on the basis that it had been put on notice of the defamatory nature of the content, and yet still allowed access to the posting (despite the Court accepting that the defendant was neither the author nor the publisher of the material).
In the present case, upon being advised of the existence of the defamatory material, immediate action was taken by the ISP to remove the offending items. However, the duties of the ISP did not stop there. Because the actual author of the material was not known, the Court held that the ISPs were effectively under an obligation to comply with the requests made by the Claimant to provide information which would reveal the identity of the author. Of particular interest is the fact that Mr Justice Owen considered this obligation so obvious that he ordered the Defendants to pay the costs of the application (this should be compared to the usual position under Norwich Pharmacal where the party seeking disclosure ordinarily bears the costs of a blameless defendant). Thus, a party which became involved, unwittingly, in a tort was compelled to disclose documents and made to pay the costs of the application seeking their disclosure.
Looking in particular at the issue of conflict between a duty of confidentiality and the obligation to disclose information, Owen J. held that section 35 of the Data Protection Act 1998 applied to the present case and that this permitted disclosure under the principles of Norwich Pharmacal i.e., the two were consistent. Accordingly, Owen J. exercised his discretion to order to disclosure, based on the following:
Owen J. balanced the interests of the parties and found:
“the respect for and protection of the privacy of those who chose to air their views in the most public of fora must take second place to the obligation imposed upon those who become involved in the tortious acts of others to assist the party injured by those acts.”
The decision of the Court must be correct in terms of justice since, as the Court noted, “to find otherwise would be to give the clearest indication to those who wish to defame that they can do so with impunity behind the screen of anonymity made possible by the use of websites on the internet”. However, what is of surprise is the judge’s findings in relation to costs.
Ordinarily in an application for disclosure under Norwich Pharmacal the party seeking disclosure will bear the costs of a blameless defendant. Owen J. found that those who operate websites containing discussion boards do so at their own risk and that it was perfectly plain in the current situation that the postings were defamatory and amounted to an actionable tort. Owen J. continued:
"I accept that the defendants had to carry out the balancing exercise, but in my judgement there was only one answer to that balancing exercise, namely that they should have complied with the requests made by the claimant. In those circumstances, I order the defendants to pay the claimant’s costs of this application/action.”
This is surprising not least by the implication that the judge found the ISPs in some way blameworthy. Not only is an ISP under an immediate obligation to remove the defamatory material, but it is also under an obligation (if a request for disclosure of identity is received) to consider whether a Court is likely to order disclosure of information relevant to identification. Should the ISP fail to do so, it will be penalised in costs. Given that orders under Norwich Pharmacal are at the Court’s discretion this obligation to consider is rather difficult, unless the following observation of Owen J. is accepted as a rule of thumb:
“If it transpires that those [discussion] boards are used for defamatory purposes by individuals hiding behind the cloak of anonymity then in justice a claimant seeking to establish the identity of the individuals making such defamatory contents ought to be entitled to their costs.”
If this is accepted, an obligation is placed on ISPs to provide details of identification in almost all circumstances where defamation is alleged. To do otherwise would likely render the ISP subject to a Court order with costs ordered against it. It is submitted that the effect of this costs ruling rather extends the exemption of section 35 of the Data Protection Act 1998, since the ISP should disclose personal information in response to an order of the Court or if the ISP considers that the Court is likely to find the content defamatory or in some way actionable. This de facto extension is surely not to be welcomed since it adds uncertainty to section 35 of the Data Protection Act 1998 and asks the ISPs to perform the “balancing exercise” themselves. It may result in ISPs providing confidential information in circumstances where no duty to provide such information exists, simply to avoid the possibility of costs penalties.