Data breach claimants lose bid for anonymity in courts

In a judgment of the High Court in Various Claimants v Independent Parliamentary Standards Authority [2021] EWHC 2020 (QB) the Claimant's application for anonymity (including being excluded from the requirement to provide their addresses on the Claim Form) and reporting restrictions that would prevent their identification was refused.

The judgment confirms that, while it may counter-intuitive that a claim for protection of personal data (as this is) necessitates the further public dissemination of those data, the bar required to obtain anonymity is set high.

Facts behind the data breach

This case concerned 216 employees or former employees of MPs (the Claimants) who alleged that, on 5pm on 30 March 2017, a member of the Defendant's staff uploaded to the Defendant's website several spreadsheets which contained private, confidential and personal information of each Claimant. This remained accessible on the website for just over 4 hours. The publication of this information was alleged to amount to misuse of private information, breach of confidence and breach of the Data Protection Act 1998.

Application for Anonymity

The default position under the Civil Procedure rules (CPR) is one of open justice so that claimants who wish to issue a civil claim must provide their full name in the Claim Form and the address at which they reside or carry on business. A claimant can also make an application for the Court to dispense the default position and to order that the claimant is anonymised. Where the Court has directed that the name of the party should be withheld, it has the power to impose restrictions that prohibit the identification of the anonymised party under the CPR and Contempt of Court Act 1981.

Authorities on derogation to open justice

CPR 39.2(4) states that:

"The Court must order that the identity of any party or witness shall not be disclosed if, and only if, it considers non-disclosure necessary to secure the proper administration of justice and in order to protect the interest of that party or witness".

The principles of open justice and the application of CPR 39.2(4) are set out in Practice Guidance (Interim Non-Disclosure Orders). These state that derogations from open justice can be justified only in exceptional circumstances when they are strictly necessary as measures to secure the proper administration of justice. The burden of establishing any derogation lies on the person seeking it and must be established by clear and cogent evidence. They should, where justified, be no more than strictly necessary to achieve their purpose.

Even in cases where privacy or confidentiality is in issue there was no general exception to open justice. The Guidance states that the Court should adopt procedures which seek to ensure that any ultimate vindication of article 8 of the Convention (right to respect for one's private and family life, his home and his correspondence), where that is engaged, is not undermined by the way in which the court has processed an interim application. However, the principle of open justice requires that any restrictions are the least that can be imposed consistent with the protection to which the party relying on their article 8 Convention right is entitled.

The authorities make clear that derogations from open justice can be justified as necessary on two principal grounds: maintenance of the administration of justice and harm to other legitimate interests. In R -v- Legal Aid Board, ex parte Kaim Todner (A Firm) [1999] QB 966, it was concluded that "parties and witnesses have to accept the embarrassment and damage to their reputation and the possible consequential loss which can be inherent in being involved in litigation. The protection to which they are entitled is normally provided by a judgment delivered in public which will refute unfounded allegations". Outside the well established cases where anonymity is provided (in prosecutions such as rape and blackmail) it seems like the principle of open justice prevails where there is a public interest served in publishing facts extended to publishing the name of a claimant.

Arguments put forward by the Claimant

The Claimants argued that without an order anonymising their identities, the purpose of bringing the claim to vindicate their rights of confidentiality and privacy would be defeated if information was brought into the public domain. The Claimants also argued that as employees and former employees of MPs, if their names or addresses were place into the public domain, this may create a personal safety risk and expose them to the risk of other harm. However, no evidence of a risk of specific harm was identified by the Claimant's counsel.

Alert system

Another issue raised by the Claimant was on the Alert Service that is used when an application for anonymisation is being considered by the court. The Alert Service enables notification to be given to the Press Association's subscribing media organisations of an application to the High Court for an order that, if granted, impacts the media's rights by prohibiting or restricting reporting of court proceedings.

The Alert Service stated, in correspondence with the Claimant's solicitors, that unless applicants were named to this service, the application would not be distributed to the media. It was held that for orders or applications to restrict use or publication of information, the Court must retain ultimate control over the information provided to third parties and any restrictions that are to be imposed on their use. The judge stated that there must have been a misunderstanding in the Alert Service's application of case  law to conclude that it required the names of the Claimants to notify media organisations in all orders for anonymisation.  

The Decision

It was held that neither of the reasons advanced by the Claimant provided a sufficient basis for grant of derogation from the principle of open justice. The orders sought for anonymity would not be necessary to maintain the administration of justice or to protect the legitimate interests of the Claimants to protect the private/ confidential information.

It was held that the court would be able to use its case management techniques and other targeted orders to properly protect the confidential and private information of each Claimant. Use of confidential schedules to statements of case and witness statements would also provide sufficient protection to the Claimants.

The argument for risk of harm was rebutted as a remote risk as it would only be likely that a very small number of people would have attitudes towards MPs that are so hostile that they might conceivably be moved to offer some threat of physical violence to a Claimant. There was also no evidence put forward of such a credible threat.

Orders restricting access by non-parties to documents on the Court File which contained confidential and private information of claimants was granted. The Claimants would also be able to use confidential schedules but beyond that their application was refused.

What this means

In a somewhat counterintuitive outcome this decision shows that when individuals are bringing an action for privacy or data breach after having personal data published unlawfully they could have to deal with having the data published again in civil proceedings. Although protection of personal information is important it must be weighed up against the principles of open justice.

The law does not provide an additional remedy for the distressed caused in pursuit of a civil claim, which names individuals. As Lord Sumption noted in Khuja -v- Times Newspapers Ltd [2019] AC 161, this collateral impact "is part of the price to be paid for open justice and the freedom of the press to report fairly and accurately on judicial proceedings held in public".