The use of Norwich Pharmacal relief to identify anonymous online users
16 June 2021
An application for ‘sole discovery’ is not provided for either by legislation or the Court Rules. Instead, an action whose aim is purely to obtain information in respect of a proposed defendant is provided for by the inherent jurisdiction of the High Court. The relief was established in Norwich Pharmacal v Customs and Excise Commissioners,1 in which Lord Reid gave the definitive statement of the principle:
‘…if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers.’2
The granting of a Norwich Pharmacal order is an entirely discretionary relief,3 and the UK courts have adopted a four-stage test.4 Recent decisions in this jurisdiction, however, have tended to focus on the issue of whether the applicant has established that a legal wrong has been committed against them, which is discussed below.
The Norwich Pharmacal procedure is commonly used as a prelude to various forms of proceedings,5 and in general terms is a very useful relief which is handled by the courts in an efficient manner. The focus of this article, however, is on an application which is brought to discover the identity of an anonymous user of an online platform – such as Facebook, Twitter or Google – who has infringed someone’s personal rights.
Concerns with this area of law, and suggested reforms
a) The requirement to prove a legal wrong
This is usually the primary issue upon which a Norwich Pharmacal application is decided. It is formulated so that such an application is not used as a ‘fishing expedition’ in the hope of discovering evidence which may ground proceedings.6 It does not appear necessary that the applicant identify the exact nature of the proceedings they intend to instigate.7 It does appear necessary, however, that they intend to use the information only for the purposes of instituting proceedings against the defendant.8 This reflects a concern that the identity may be sought for a collateral purpose, such as harassing someone who posted content that may be objectionable to the applicant, but is not unlawful.
This was an issue in the very recent decision in Salesian College v Facebook [2021] IEHC 287, in which the High Court has referred several questions to the CJEU in respect of Norwich Pharmacal applications. The central issue in Salesian College was that the applicant does not intend to bring legal proceedings against the unknown operators of an Instagram account which has included offensive content about some of the school’s teachers and pupils. Instead, it is seeking their identities so that the school’s Board of Management may deal with the issue by way of what it described as “a disciplinary or pastoral response.” In mid-June 2021, however, proceedings were withdrawn by the plaintiff, and along with it the CJEU reference.
An issue in respect of Norwich Pharmacal applications which is not entirely clear is the threshold of proof that an applicant must reach in respect of whether a wrong has been committed. In the UK, the current test appears to be that the applicant must make out an “arguable case.”9There is less clarity, however, in this jurisdiction.
In the case which first approved the granting of Norwich Pharmacal relief in this jurisdiction, Megaleasing & Ors v Barrett & Ors [1993] IRLM 497,10 Finlay CJ held that “the existing authorities … do in fact confine the remedy to cases where a very clear proof of a wrongdoing exists.”11The recent High Court decision in Blythe v Commissioner of An Garda Síochána [2019] IEHC 854, however, rejected the suggestion that evidence of wrongdoing was required to be established “to a high degree of certainty.”13 Instead, the Court approved the finding in EMI Records Ireland Limited v Eircom Limited & Anor [2005] 4 IR 148 that the test required a “prima facie demonstration of wrongful activity.”15
The adoption of this test from EMI raises certain questions. The case concerned an application by record companies to discover the identities of Eircom’s customers who were infringing the former’s copyright by illegally downloading material. Firstly, EMI can be distinguished from the more traditional Norwich Pharmacal applications in that the applicants were seeking not to institute legal proceedings against the defendants, but rather warn them to desist or face having their internet connection terminated.
Secondly, Kelly J’s finding appeared to be focussed on the obligation of confidentiality that the respondent had towards its customers, emphasising that prima facie evidence of wrongdoing will override any duty of confidentiality owed by an internet service provider to a customer.16 It is unclear, therefore, whether he intended to establish a general threshold of proof required to ground a Norwich Pharmacal application in the first place.
b) The lack of jurisdiction for the Circuit Court
Norwich Pharmacal orders are provided courtesy of the inherent jurisdiction of the High Court. The Harassment, Harmful Communications and Related Offences Bill, as introduced in 2017, proposed to not only codify the procedure, but also extend its availability to the Circuit Court. The proposed Section 14, however, did not survive the enactment of the Bill in December 2020.17 Many of the proceedings which arise from online harm involve defamation and breach of data protection rights, both of which are regularly instituted at Circuit Court level. It is regrettable, therefore, that a prospective plaintiff is required to bring a plenary action to the High Court, with the higher cost which that entails, simply to obtain the identity of the party against whom they wish to institute proceedings in the lower court.
c) The potential costs to be borne by the applicant
A further issue of uncertainty is how the traditional rule that costs follow the event should be applied in Norwich Pharmacal proceedings which do not follow the traditional, adversarial format.18Following the original decision in Norwich Pharmacal,19 the general rule in the UK is that the applicant will pay for the cost of the application,20 on the basis that such costs can ultimately be recovered by the applicant from the wrongdoer.21 This principle, unfortunately, ignores the practical reality that a defendant who anonymously posts content online is very often impecunious, and not in a position to satisfy an award for damages, let alone the significant cost of High Court proceedings.
The position appears to be different in this jurisdiction. In the recent decision in Blythe v The Commissioner of An Garda Siochána, the High Court held that the traditional rule that costs follow the event should be applied in Norwich Pharmacal proceedings, the “event” being the successful application for the Order.23 Other than this decision, however, a practice appears to have developed that no order for costs be made.24 In the very recent decision in Salesian College v Facebook, however, the High Court remarked that the respondent will ordinary be entitled to their costs as against the applicant, a finding which creates further uncertainty as to the correct position concerning costs in such applications.
While an agreement between the parties as to costs is not something that a court should ordinarily interfere with, clarity in respect of this issue would be welcome. While it is true to say that Norwich Pharmacal applications are not ‘adversarial’ in the traditional sense, the suggestion that the respondent is an entirely innocent party who should be awarded their costs merits closer attention in the particular circumstances of applications against online platforms. Furthermore, while they may adopt a ‘neutral position’ to such an application in Court,26 the online platform has already declined to provide the information voluntarily at first instance, and consequently obliged an applicant to incur significant High Court costs. In those circumstances, it is arguable that the applicant’s obtaining of an order is a “victory” and that the traditional rule of costs following the event should be applied. This is expanded on below.
d) The necessity to apply for relief in the first place
The fundamental reason why the type of Norwich Pharmacal application being considered here requires to be instituted is that the user of a particular online network is operating anonymously. The benefits of anonymity, in terms of fostering positive discussion, enabling whistleblowing and facilitating freedom of expression, are self-evident. The downside of facilitating anonymous posting of content is that it encourages unlawful content. In respect of direct legal liability for such material, online platforms are provided robust protection for the material they host by Article 14 of the E-Commerce Directive.27 Furthermore, the general position of such platforms when requested to identify users who post such content is that they are ‘not in a position’ to arbitrate as to whether the material a user has uploaded is unlawful.28
There is an inconsistency in this position. Online platforms make decisions as to lawfulness in respect of millions of items of content, every time they deal with a notice and take-down request or suspend a person’s account. Why they should consider themselves unable to adjudicate whether a complainant may have grounds to litigate against another user – an adjudication which does no more than allow proceedings to be instituted, and does not involve any punitive action against the anonymous user – is unclear.
There would appear to be no procedural inability on a platform’s part to make legal judgments about the material they host, and there is also little in the way of legal impediment to them doing so.29 The fundamental reason why users can operate anonymously is because the online platform allows them to. While platforms are traditionally very protective about the right of their users to operate anonymously,30 there is no such thing as an absolute legal right to anonymity.31 It is at the discretion of a platform hosting user-generated content as to whether they require the user to identify themselves when posting material.32
Furthermore, privacy and data protection rights are not unqualified. The Constitutional right to privacy is subject to the Constitutional rights of others and the preservation of public order, morality and the common good.33 Likewise, in respect of data protection, the rights of data subjects are qualified by the requirement to protect the rights and freedoms of other persons.34
The issues raised by the balancing of these rights was very recently referred to by Simons J. in Salesian College v Facebook, in which he stated that “there is a strong argument that persons using a social media platform anonymously have an expectation that their identity will not be disclosed without their consent. This is subject, of course, to any countervailing public interest in the disclosure of their identity.” The Court’s uncertainty as to the parameters of the right to anonymity resulted in it making a reference to the Court of Justice as to whether the rights protected by Articles 7, 8 and 11 of the Charter of Fundamental Rights imply a right, in principle, to post material anonymously on the internet.
The Constitutional right of access to justice by an injured party is clearly a right that would be also engaged, as both the use of anonymity, and the expense currently involved in obtaining the identity of an anonymous defendant, would appear to create obstacles to justice.35
The fact that online platforms do not require documents which verify users’ identity when signing up to use the platform creates further difficulties for an applicant seeking Norwich Pharmacal relief. After obtaining what information the respondent has in respect of the proposed defendant, it often transpires that such information does not provide much assistance in establishing their true identity.36 The plaintiff may therefore find themselves in the unsatisfactory position of having borne their costs of a plenary application, only for the information provided to be of no evidential value.
e) Potential difficulty with the Statute of Limitations
A further adverse consequence of being obliged to apply for Norwich Pharmacal relief to obtain the identity of anonymous online users is the delay that this can cause to the plaintiff being able to institute proceedings against the correct defendant. This potential prejudice was recently alluded to in Blythe v Commissioner of An Garda Síochána.37 In circumstances where a plaintiff wishing to institute proceedings in defamation must do so within one year38 of the defamation having been published online, a delay on the part of an online platform in responding to a request for information concerning the identity of the proposed defendant is clearly problematic.
This issue was recently addressed by the High Court in a case involving a former Leitrim TD who had been the subject of allegedly defamatory material on social media.39 Due to the failure of Norwich Pharmacal orders to provide information which identified the wrongdoers, the Court was willing to allow ‘Persons Unknown’ to be joined to the defamation proceedings, meaning they could be instituted before the Statute became an issue. The difficulty with this, however, is that the plaintiff has had to make Norwich Pharmacal applications in the High Court, an application to join Persons Unknown, and will be faced with a further application to substitute the correct defendant(s), incurring considerable costs before proceedings have even been instituted against the correct wrongdoer. This is clearly an unsatisfactory state of affairs from a plaintiff’s point of view.
How this area of law could be reformed
a) Refine the threshold test
It is unclear whether the ‘prima facie’ standard is that which is required to ground the application in general terms, or whether it is a test to be later applied when the Court, in exercising its ultimate discretion, is considering the issue of a defendant’s expectation of confidentiality in respect of the information. A definitive judicial statement would be welcome.
b) Provide clarity as to the manner in which costs will traditionally be awarded
The policy of the UK courts to oblige an applicant to bear the cost of Norwich Pharmacal applications appears unjust, placing as it does an unnecessary obstacle in respect of access to justice before a victim of online harm. While the courts in this jurisdiction do not appear to have followed this policy, the very recent decision in Salesian College v Facebook has cast further doubt as to the correct position. A judicial pronouncement that, in the absence of circumstances which permit a departure from the rule, costs will traditionally follow the event – the ‘event’ in this case being an order to disclose information which the respondent failed to provide voluntarily – would be welcome.
c) Provide for the application in the Court Rules, and allow for it to be brought before the Circuit Court
Related to the issue of costs, the inability to obtain Norwich Pharmacal relief from the Circuit Court is regrettable.40In the majority of reported decisions involving applications against online platforms, there is rarely any substantial argument on the facts, and once the applicant has established evidence of being wronged, the respondent tends not to raise any objection. It is unclear as to why this procedure requires an applicant to incur the expenses involved in bringing plenary proceedings to the High Court, and the incorporation of such an application into the rules of both the Superior Courts and the Circuit Court is suggested.
d) Provide a mechanism whereby online platforms must take greater responsibility for adjudicating in such applications
The forthcoming Online Safety and Media Regulation Bill provides an ideal opportunity for legislative action in this regard. One of the purposes of the Bill is to create an Online Safety Code, regulating the manner in which online service providers, such as the large social media platforms, deal with harmful content. The following provisions could be considered:
1) Platforms should oblige users to provide verifiable identification when joining as a means of discouraging unlawful behaviour online. This will, at the very least, result in the obtaining of a Norwich Pharmacal order not proving to be a futile exercise for the applicant.
2) The terms and conditions under which online platforms operate should indicate that if a user chooses to operate anonymously, information as to their identity may be disclosed if an applicant establishes a satisfactory case that the online user has infringed their rights.
3) Platforms should be required to set up a division to deal specifically with requests to identity anonymous online users. The test that it applies in respect of whether such information should be provided would be based on the current test employed in Norwich Pharmacal proceedings. Should the request be turned down, a right of appeal to an independent body – similar to Facebook’s recently-formed “Oversight Committee” – should be available.41
e) Amend the Statute of Limitations
For the purposes of the limitation period, a provision similar to section 50 of the PIAB Act 2003 could operate in respect of a claim against an anonymous online user. The period beginning on the making of a request to the online platform for information concerning the wrongdoer’s identity, and ending upon a response being received from the platform either providing such information, or stating that they are unwilling to so, should be disregarded for the purposes of Section 11 of the Statute of Limitations Act 1957.
Conclusion
There is nothing of itself objectionable about a decision of the English High Court, born of analogue times, continuing to be followed in the digital 21st century. The common law has repeatedly shown itself to be robust and adaptable enough to be relevant to technologies which could not have been envisaged when decisions were first handed down.
But there is a strong argument to be made for the fact that the Norwich Pharmacal procedure comes from a time when the anonymity of defendants was an uncommon issue, which can no longer be said due to the widespread use of anonymity by users of the internet. As the cost of litigation is often cited as an obstacle in obtaining access to justice, it is unsatisfactory that a further obstacle should be put before plaintiffs whose personal rights have been violated, by obliging them to bring a plenary action to the High Court, particularly in circumstances where it may well turn out to be a futile exercise.42
Concluding with the original decision upon which the jurisdiction is based, Lord Cross suggested that in a case with similar facts to the one before him, the respondent would most likely accede to the original request for information “without putting the applicant to the expense of obtaining an order.”43 This is a suggestion which has not been followed by online platforms, whose default position appears to be a refusal to disclose such information without a court order.
The question of expense may be dealt with through the availability of the relief in the Circuit Court, and by a definitive judicial declaration as to the right of an applicant to obtain a costs order in their favour following the granting of relief. The very necessity of bringing such an application, however, is worthy of review, with the forthcoming Online Safety and Media Regulation Bill providing an ideal opportunity to do so.
Ends.
* This article was updated on 18 June 2021 to reflect the fact that the proceedings in Salesian College v Facebook [2021] IEHC 287 were withdrawn by the plaintiff in mid-June.
This article won first prize in the Young Bar of Ireland’s Article Competition 2021.
1 Norwich Pharmacal v Customs and Excise Commissioners [1974] AC 133.
2 Norwich Pharmacal v Customs and Excise Commissioners (1973) AC 133, 175.
3 As Peart J stressed in Muwema v Facebook [2018] IECA 104, at para 2: “It is not an order made as of right, even where there is prima facie evidence of wrongdoing shown to exist on the part of the person whose identity is sought to be disclosed. There may in any particular case be countervailing facts and circumstances which would warrant a refusal of an order.”
4 In Collier v Bennett [2020] EWHC 1884 (QB), this was explained as 1) has a good arguable case been made that a legal wrong has been committed; 2) was the respondent mixed up in the wrongdoing; 3) can the respondent provide information necessary to enable the ultimate wrongdoer to be pursued; and 4) is disclosure from the respondent an appropriate and proportionate response in all the circumstances of the case?
5 It could be to identify a party who is infringing another’s intellectual property rights, as per the originalNorwich Pharmacal proceedings; to identify a co-worker who made a complaint which had led to an employee being dismissed, as perP v T Ltd [1997] 1 WLR 1309; or to obtain disclosure of information from the Stock Exchange about alleged unlawful market manipulation, as per Burford Capital Ltd v London Stock Exchange Group Plc [2020] EWHC 1183 (Comm).
6 See, inter alia, Singularis Holdings Ltd v PricewaterhouseCoopers [2015] AC 1675, Ramilos Trading Ltd v Buyanovsky [2016] EWHC 3175 (Comm), para 46, and Hickox v Dickinson [2020] EWHC 2520 (Ch), para 36.
7 In Hickox v Dickinson & Anor [2020] EWHC 2520 (Ch), the High Court stressed at para 50 that “In all Norwich Pharmacal applications the claimant’s case is partly inchoate, that is the very point of the relief.” See alsoP v T Ltd [1997] 1 WLR 1309.
8 See, inter alia, Parcel Connect v Twitter [2020] IEHC 279. This does not necessitate legal proceedings to be instituted, as negotiations to settle the claim with the defendant will also suffice. In GoldenEye & Ors v Telefonica (UK) [2012] EWCA 1740, the Court of Appeal stressed that “It is not necessary for a claimant for Norwich Pharmacal relief to demonstrate an intention to commence proceedings. In small claims of this kind a negotiated settlement is both effective and preferable.”
9 See, inter alia, Ramilos Trading Ltd v Valentin Mikhaylovich Buyanovsky (2016) EWHC 3175 (Comm). In GoldenEye & Ors v Telefonica (UK) [2012] EWCA 1740, the English Court of Appeal described the test as being “had arguable wrongs been committed against the claimants?”, para 7.
10 Megaleasing & Ors v Barrett & Ors [1993] IRLM 497.
11 Megaleasing & Ors v Barrett & Ors [1993] IRLM 497, 504. In this regard, see also Doyle v The Commissioner of An Garda Siochana [1999] 1 IR 249 and Ryanair v Johnston [2006] (Unreported, High Court, 12 July 2006).
12 Blythe v Commissioner of An Garda Síochána [2019] IEHC 854.
13 O’Brien v Red Flag [2017] IECA 258.
14 EMI Records Ireland Limited v Eircom Limited & Anor [2005] 4 IR 148.
15 The ‘prima facie’ test was also recently followed in O’Brien v Red Flag Consulting Limited [2017] IECA 258 and Parcel Connect v Twitter [2020] IEHC 279.
16 “I am satisfied that whether the right to confidentiality arises by statute or by contract or at common law, it cannot be relied upon by a wrongdoer or a person against whom there is evidence of wrongdoing to protect his or her identity. The right to privacy or confidentiality of identity must give way where there is prima facie evidence of wrongdoing.’EMI Records (Ireland) Ltd & Ors v Eircom Ltd & Anor [2005] 4 IR 148,152.
17 See https://www.oireachtas.ie/en/debates/debate/select_committee_on_justice/2020-12-01/3/, section 14.
18 “Norwich Pharmacal applications are not ordinary adversarial proceedings, where the general rule is that the unsuccessful party pays the costs of the successful party,” Totalise v The Motley Fool [2001] EWCA Civ 1897, para 29.
19 Lord Cross held that “the full costs of the respondent of the application and any expense incurred in providing the information would have to be borne by the applicant.” Norwich Pharmacal v Customs and Excise Commissioners (1973) AC 133, 199. See also the recent decision in Jofa Ltd v Benherst Finance Ltd [2019] EWCA Civ 899 in which the Court of Appeal held that “While accepting that there can be no absolute rule in the matter, I find it hard to envisage circumstances in which it would be just to award costs against a respondent to a Norwich Pharmacal application…”
20 The Court may depart from this position, however, if it finds that the respondent has no legitimate issue in relation to disclosing the information voluntarily. See Totalise v The Motley Fool [2001] EWCA Civ 1897, para 30.
21 See inter alia, Totalise v The Motley Fool [2001] EWCA Civ 1897, and JSC BTA Bank v Ablyazov & Ors [2014] EWHC 2019 (Comm).
22 Blythe v The Commissioner of An Garda Síochána [2019] IEHC 854.
23 Having heard the parties further as regards the costs of the proceedings, including the motion, those follow the event in favour of the plaintiff.” In respect of the costs of compliance with the order, the court factored in the behaviour of the defendant towards the request for discovery, before concluding that no order for costs should be made in that regard. Blythe v The Commissioner of An Garda Siochána [2019] IEHC 854, para 35.
24 See, inter alia, Parcel Connect v Twitter [2020] IEHC 279, in which the Court concluded at para 25 that “will be no order as to costs.”
25 https://www.independent.ie/irish-news/courts/social-media-influencer-who-claims-she-is-being-stalked-online-granted-court-order-requiring-facebook-to-provide-her-information-to-identify-alleged-trolls-39491575.html
26 See, inter alia, G v Wikimedia Foundation Inc [2009] EWHC 3148 (QB), Muwema v Facebook [2017] IEHC 69 and Parcel Connect v Twitter [2020] IEHC 279, para 13.
27 Directive 2000/31/EC.
28 In Muwema v Facebook Ireland Ltd [2017] IEHC 69, the respondent explained its traditional stance of remaining neutral in applications for Norwich Pharmacal relief, on the basis that “the court is the appropriate arbiter as to whether or not the application is meritorious; a role Facebook is not in a position to fulfill.”
29 There does not appear to be anything in Facebook’s terms and conditions of use which prevents them from sharing information that identifies anonymous users when requested to do so by a third party who feels their rights have been violated. In its Privacy document, Facebook states that “We access, preserve and share your information with regulators, law enforcement or others … in response to a legal request, if we have a good-faith belief that the law requires us to do so. We can also respond to legal requests when we have a good-faith belief that the response is required by law in that jurisdiction, affects users in that jurisdiction, and is consistent with internationally recognized standards.” Available athttps://www.facebook.com/privacy/explanation. Twitter’s Privacy Policy is phrased in similar terms. Available athttps://twitter.com/en/privacy, para 3.3.
30 A press release recently issued by Twitter stated that: “Pseudonymity has been a vital tool for speaking out in oppressive regimes, it is no less critical in democratic societies. Pseudonymity may be used to explore your identity, to find support as victims of crimes, or to highlight issues faced by vulnerable communities.” See https://www.irishtimes.com/sport/soccer/twitter-won-t-prevent-anonymous-users-in-fight-against-racism-1.4489929
31 In The Author of a Blog v Times Newspapers Ltd [2009] EWHC 1358 (QB), the English High Court rejected the proposition that the plaintiff could establish a legally-enforceable right to operate anonymously on the internet.
32 In KU v Finland(App No 2872/02) (2 December 2008) ECHR, the ECtHR stressed at para 49 that the right of internet users to maintain anonymity “should yield on occasion to other legitimate imperatives, such as the prevention … of crime of the protection of the rights and freedoms of others.” Likewise, the English High Court held that it even in circumstances where the issue of privilege may apply, it was not impermissible for a solicitor to reveal the identity of a client to an applicant who wished to pursue the latter for defamatory comments made on a blog, holding that “the provision of an individual’s name, address and contact number cannot, without more, be regarded as having been made in connection with legal advice. SRJ v Person(s) Unknown, D & Co [2014] EWHC 2293 (QB).
33 Kennedy & Ors v Ireland & Ors[1987] 1 IR 587, at 592.
34 General Data Protection Regulation, Article 94(2)(e).
35 This was recently referred to in Blythe v Commissioner of An Garda Síochána [2019] IEHC 854, para 6.
36 In Parcel Connect t/a Fastway Couriers & Anor v Twitter [2020] IEHC 279, the respondent platform position was “it has nothing to say as to what the information should be and does not warrant that such information as it has will be sufficient to allow the plaintiffs to establish the true identity of the owner and operator of the account,” at para 20.
37 The Court noted that “if the limitation period is going to expire imminently and the plaintiff is not given the necessary information to institute proceedings within that period, it is nonsensical to suggest that he is not prejudiced.” Blythe v Commissioner of An Garda Síochána [2019] IEHC 854, para 19. See also Proudfoot v MGN Ltd [2019] IEHC 871, para 41.
38 The Court has discretion to extend this period by a further 12 months, as per section 38(1)(a) of the Defamation Act 2009.
39 https://www.leitrimobserver.ie/news/home/605560/ex-td-frank-o-rourke-allowed-join-person-unknown-to-defamation-proceedings.html
40 In England and Wales, for example, such applications may be made in the County Court, as well as the High Court.
41 While this independent Committee, created by Facebook in 2020, deals with appeals from the author when their content which has been removed, or from users who have failed to have the content of others removed, it does not appear that it will entertain appeals in respect of decisions not to identify anonymous users. Its scope should be extended to enable it to hear such appeals.
42 See fn 36.
43 Norwich Pharmacal v Customs and Excise Commissioners (1973) AC 133, at 199.