According to a recent decision in England, Totalise PLC v Motley Fool Ltd & Anor in February this year, the English court ordered two operators of web sites to disclose the identity of one of their subscribers, and made costs orders against these two operators for failing to disclose the information to the claimant.
The facts are these. The claimant was an Internet service provider. Each of the defendants operated a web site containing discussion boards on which members of the public were able to post material.
An anonymous contributor, who called himself Z Dust, made numerous defamatory statements about the claimant posting them on the defendant's discussion boards. The court found that most of the statements were defamatory.
Z Dust first posted the defamatory statements of the under of the claimant on the first defendant's discussion board. After receiving complaints from the claimant, the first defendant permanently barred Z Dust's access to the first defendant's web site. Undeterred, Z Dust registered the same name with the second defendant and continued to post the defamatory statements of the claimant on the second defendant's discussion board.
The defendants in this case removed the defamatory material from their respective web sites after receiving the claimant's complaints. However, both defendants refused to release the personal details of Z Dust relying on the English Data Protection Act.
The claimant filed a court application seeking disclosure of the identity of Z Dust, or of any material in the possession of or accessible by the defendants that could lead to the identification of Z Dust.
After careful consideration of the personal privacy law and the interest of all the parties, the court ordered the defendants to disclose the identity of Z Dust and disclose the related documentation. The court took into account the following factors when coming to this conclusion.

  • the material posted by Z Dust was "plainly defamatory" and the defamatory material was of a very serious nature. The claimant has demonstrated a strong prima facie case against Z Dust;
  • as there is no geographical limit on the Internet, the potential audience is vast, and these factors presented a very consider- able threat to the claimant;
  • Z Dust was conducting the above activities under disguise through accessing the defendants' discussion boards;
  • the claimant had no other practical means of identifying Z Dust.

Another important point to note in this case was that the court ordered the defendants to bear the costs of the claimant's application. In normal circumstances, where an innocent third party is ordered to disclose documents concerning legal proceedings or potential legal proceedings, the applicant is usually required to bear the costs of such an application. In this case, however, the court found that those who operated websites containing discussion boards did so at their own risk. Therefore, the providers of bulletin board facilities would have to bear the risk of any legal costs if its board were used for defamatory purposes.


Although this is an English authority, it may nevertheless have some influence on the Hong Kong court. Web site operators who run discussion boards without auditing the contents of the material posted on the discussion boards should be aware of their duties under the Personal Data (Privacy) Ordinance (PDPO) as well as their duties to disclose personal information of their subscribers under certain circumstances.
It may not be sufficient for a web site operator to deny a third party's request for personal information of its subscribers by relying on the Data Protection Principles before disclosing such under the PDPO alone. A Hong Kong web site bulletin board operator, has recently been sued by E-Silkroad Holdings for libel. The statements concerned were posted by an anonymous user of E-Silkroad seeks damages from and requests to reveal the real names, addresses, email addresses and Internet Protocol (IP) addresses of the anonymous users who sent the messages.
Following the decision of the Court in Totalise v Motley, it would appear likely that icered would be ordered to disclose the information sought and possibly pay costs.
If uncertain, a web site operator should seek the assistance of the Privacy Commissioner for Personal Data before disclosing such information.

First published in e-lawasi@ in May 2001.