This case suggested that someone defamed by an anonymous user of a bulletin board could require the bulletin board owner to disclose their subscribers' identity. A bulletin board owner who failed to do this and required a court order before disclosure could be penalised by being forced to pay the costs of the person applying for the order.

A Court of Appeal decision on 19 December 2001 overturns this and concludes that a bulletin board owner can safely require a court order before disclosing a subscriber's identity, where a bulletin board owner has reasonable concerns that releasing the information may breach a duty of confidence or the Data Protection Act 1998. Furthermore, the Court of Appeal suggested that orders requiring the bulletin board owner to disclose the identity of a subscriber should not generally be made without the bulletin board owner first having approached the subscriber and advised the applicant and the court of any reasons put forward by the subscriber as to why their identity should be protected.

The Case

A subscriber to bulletin boards operated by Interactive Investor (II) and The Motley Fool, using the pseudonym of Zeddust, posted defamatory statements about Totalise, a US-based ISP. Totalise asked II and Motley Fool for details as to Zeddust's identity, so as to allow it to consider bringing proceedings against Zeddust. Motley Fool and II both refused, on the grounds that the Data Protection Act 1998 may prohibit disclosure of the information and that disclosure would be inconsistent with their terms and conditions and their privacy policies, both of which required II and Motley Fool to respect their subscriber's privacy. Totalise sought a court order requiring II and Motley Fool to disclose Zeddust's identity.

Owen J granted the order requested by Totalise. In an application of this nature (a Norwich Pharmacal application), it is usual for the party seeking the order to pay the costs of the person against whom the order is made. Unusually, in this case, Owen J ordered II and Motley Fool to bear Totalise's costs. The Judge did this on the basis that the defendants should have carried out a balancing exercise when considering whether or not to disclose Zeddust's identity. The Judge took the view that the statements were so clearly defamatory that there was only one possible way that they could have decided. The Judge was also influenced by Totalise's suggestions that those who operate bulletin boards do so at their own risk; if bulletin boards are used for defamatory purposes by individuals who seek to remain anonymous, then claimants who are forced to seek an order revealing the identity of the person making such statements should be entitled to their costs. (The implications of this decision for bulletin board operators were considered in IT Law Today November/December 2001.)

Interactive Investor appealed against the costs order. It argued that Owen J should have distinguished II's behaviour from that of Motley Fool. Whereas Motley Fool had opposed Totalise's application for an order requiring the disclosure of Zeddust's identity, II had not. The real purpose of a Norwich Pharmacal order is for the Court to protect someone who is not a party to litigation but who holds relevant information and who has reasonable doubts about the propriety of disclosing this information, by ordering the disclosure of the information at the expense of the person seeking the disclosure.

The Court of Appeal upheld II's argument. They rejected Totalise's argument that bulletin board owners should be forced to bear the costs of such applications to ensure that they acted responsibly and to prevent the web from becoming a "vehicle for anonymous scurrilous allegations".

Aldous LJ concluded that in these cases, the applicant should meet the bulletin board owner's costs where:

  • the bulletin board owner has a genuine doubt that the applicant is entitled to the information
  • the bulletin board owner is under an appropriate legal obligation not to reveal the information, or where the legal position is not clear, or the bulletin board owner has a reasonable doubt as to its obligations
  • the bulletin board owner could be subject to legal proceedings if it were to disclose the information voluntarily
  • the bulletin board owner would or might suffer damage by making the disclosure voluntarily
  • the bulletin board owner would or might infringe the legitimate interests of another.

Aldous LJ noted that the analysis may be different if the bulletin board owner was in someway implicated or involved in the wrongful act of its subscriber.

Aldous LJ also considered the impact of the Data Protection Act 1998 and the Human Rights Act 1998 on the Court's discretion to make an order requiring the identification of Zeddust. As the appeal was limited to the costs order, these comments are obiter.

As regards the Data Protection Act 1998, Aldous LJ noted that Section 35 provides an exemption from certain provisions of the Act where disclosure is "necessary for the purposes of establishing, exercising or defending legal rights". Aldous LJ also considered Schedule 2 to the Data Protection Act, which requires that a data controller satisfy at least one statutory pre- condition before disclosing, or otherwise processing, personal data. The Judgment refers to Schedule 2, paragraph 5 (a), which allows disclosure for the administration of justice and Schedule 2, paragraph 6, which applies where processing is necessary for the purposes of legitimate interests pursued by the data controller or third parties to whom the data are disclosed. This pre-condition does not apply where "the processing is unwarranted in any particular case by reason of prejudice to the rights and freedoms or legitimate interests of the data subject", Aldous LJ suggested that the effect of this paragraph was to mean that the Court should not make an order for disclosure of a data subject's identity unless the court had first considered whether the disclosure would be warranted having regard to the rights and freedoms or the legitimate interests of the data subject. His comments seem to suggest that the Court (and perhaps a bulletin board owner) would need to carry out this balancing test even if it could satisfy another Schedule 2 condition (such as the administration of justice condition). This is not correct; a data controller need only satisfy one of the conditions in Schedule 2.

Aldous LJ also noted that, irrespective of the Data Protection Act 1998, the Human Rights Act 1998 would require the Court to consider whether an order requiring the identification of Zeddust would unjustifiably invade his or her rights to respect for private life. 1 Aldous LJ noted that this was especially of concern when the individual was not represented before the Court. Failure to consider this could, possibly, also amount to a breach of Article 6(1) (right to a fair trial).

Aldous LJ suggested that in proceedings relating to the disclosure of the identity of a subscriber to a bulletin board, the court could require the bulletin board operator to consult with its user and to notify the claimant and the court of any arguments put forward by the user as to why his or her identity should not be disclosed. Aldous LJ suggested that this could be done before the Court made any order requiring the disclosure of the identity of a bulletin board user.

Conclusions

The Court of Appeal decision not only overturns the costs order made against II at the first instance. It also suggests that greater care should be taken in future before orders are made requiring bulletin board owners to disclose the identity of their subscribers.

Where a bulletin board owner undertakes to protect its subscriber's privacy, either in its terms and conditions or in a privacy policy, and is then asked to reveal the identity of a subscriber to a party considering legal proceedings against that subscriber, the bulletin board owner can now require the applicant to obtain a court order and to meet its associated costs.

If a bulletin board owner did not address the question of its subscriber's privacy either in its terms and conditions or in its privacy policy, then the situation is less clear. It is not clear whether such a bulletin board operator could satisfy a statutory pre-condition under the Data Protection Act 1998 when disclosing such information in all but the most flagrant and clear-cut of cases - for example, if disclosure was required to prevent an immediate threat of harm to others. As there is reasonable doubt about the application of the Data Protection Act 1998, it seems likely that such a bulletin board operator could also require a court order before disclosing a subscriber's identity and to have its costs met.

Bulletin board owners should, however, take note that they may still be forced to bear the cost of applications if they actively oppose the order or if they are implicated or in any way involved in their subscriber's wrongful act.

First published in the February 2002 edition of IT Law Today.

1 The Judgment refers to Article 10 (Freedom of Expression). This appears to be an error. The correct reference should be Article 8.

Authors