Court of Appeal reviews procedure for ordering disclosure of website user identities


Norwich Pharmacal orders are commonly used in the UK to compel platforms such as ISPs and user generated content sites to identify a person who has committed a tort such as defamation. This recent decision of the Court of Appeal sets out guidance as to the information that must be provided and who should bear the costs of these orders.

On 15 April 2008, the Court of Appeal gave judgment in a case involving Norwich Pharmacal orders – the orders used by claimants to compel third parties to co-operate in identifying a person who has committed a tortious act such as defamation. In its judgment, the court gave useful guidance as to the extent to which claimants must organise allegedly defamatory material in their evidence and only seek disclosure of the identity behind postings that legitimately serve their purpose. The court also discussed the need for a claimant to pay the website operator’s costs in complying with these types of orders.

This case concerned a request for information about the persons behind 23 avatars responsible for 109 separate postings that were allegedly defamatory. The appeal in this case (Smith v ADVFN plc [2008] EWCA Civ 518) followed an original order in April 2007 under which the respondent was to provide Mr Smith with the registered name, address, email address and IP address. However, the respondent, a company that operated a bulletin board on its stock exchange news website, provided the IP addresses given at the point the users had registered. This, Mr Smith argued, prevented him from verifying the users’ identities with their internet service providers as he needed the IP address used to post the allegedly defamatory material. He therefore submitted a further application to the court and this was considered by Mackay J on 13 March 2008.

In this second application, Mr Smith set out two options. The first option was for disclosure relating to 252 postings by 64 avatars since April 2007; the second option related to 100 or so postings by the original 23 avatars subject to the original order. Both options sought the users’ names, addresses, email addresses and the IP addresses captured on the day that the allegedly defamatory postings were made. In evidence, the respondents submitted that the cost of complying would exceed £50,000. Mr Smith disputed this and sought to allow an expert to review the complexity. Mackay J stated that this would be inappropriate given the nature of the application as it would require a full-scale trial. The judge made an order based on the second option before him, having decided not to examine the postings to see whether they were in fact defamatory.

Mr Smith appealed arguing that the judge had erred in rejecting the broader option for disclosure. Lord Justice May dismissed the appeal and confirmed that:
  • a website cannot merely disclose the identity of its users without a court order, both because of the subject’s statutory rights (under the European Convention on Human Rights and the Data Protection Act) and because as individuals they have a contractual expectation of anonymity. Furthermore, it was important to bear in mind that the people affected were not represented before the court. This reiterates the High Court’s view from the recent Sheffield Wednesday case.

  • a claimant for a Norwich Pharmacal order should organise the material it was presenting to the court so that the court “may readily see that a wrong has arguably been committed”. The claimant should seek to discriminate in order to reduce the number of postings which will legitimately serve his purpose. The court was not obliged to consider an indiscriminate and disorganised submission of material from bulletin boards. Lord Justice May recognised that Mr Smith could make a new application if he took steps to reduce the scope of the application.

  • the respondents to these types of applications should in ordinary circumstances have their costs paid by the claimant. In this case there was a question over whether Mr Smith could pay these costs even were his defamation claims to be successful. The claimant could not take for granted that the court would make an order in the hope that he would be able to pay the mounting costs at some indefinite future date. Lord Justice May made it clear that this was without prejudice to the fact that a judge considering a new application would have discretion as to the costs order made.

This case makes it clear that there is a balance to be struck between, on the one hand, individuals’ rights to privacy and freedom of speech and, on the other hand, an injured party’s right to identify a wrongdoer against whom they can take action. This is consistent with the recent ECJ Promusicae decision. The court has made clear that a claimant has an obligation to present its case in such a manner as to allow the court to see that libel has arguably been committed. The court will not allow the claimant to cast too broad a net in these kinds of applications.