The Rugby Football Union v Consolidated Information Services Limited (Formerly Viagogo Limited) (In Liquidation)

before

Lord Phillips
Lady Hale
Lord Kerr
Lord Clarke
Lord Reed

JUDGMENT GIVEN ON

21 November 2012

Heard on 14 June 2012

Appellant Martin Howe QC Tom Moody-Stuart (Instructed by Lewis Silkin LLP)

Respondent Lord Pannick QC James Segan (Instructed by Kerman & Co LLP

LORD KERR (with whom Lord Phillips, Lady Hale, Lord Clarke and Lord Reed agree)

1. The Rugby Football Union (the RFU) is the governing body for rugby union in England. It owns the famous Twickenham stadium, the home ground of the England rugby football team. The RFU alone is responsible for issuing tickets for international and other rugby matches played at the stadium.

2. As one would expect in light of the growing popularity of rugby union football, demand for tickets for home international games at Twickenham regularly greatly outstrips the number of tickets available, notwithstanding that the stadium has a capacity of 82,000. The RFU does not allow this circumstance to inflate the cost of tickets, however. On the contrary, it is their deliberate policy to allocate tickets so as to develop the sport of rugby and enhance its popularity. Most tickets for international matches are therefore distributed by the RFU to participants in the sport, via affiliated rugby clubs, referee societies, schools and other bodies which organise rugby. The distribution of the tickets thereafter depends on the nature of the body in question. Schools, for instance, are permitted to distribute tickets to “any member of staff, pupil or genuine sponsor”. Member clubs are permitted to sell some or all of their ticket allocation (up to a combined maximum of 4,837 tickets per match across all member clubs) to official licensed operators who then use those tickets to provide official hospitality packages. The RFU’s share of the profit from this goes towards the player accident and liability insurance scheme.

3. The RFU’s terms and conditions stipulate that any resale of a ticket or any advertisement of a ticket for sale at above face value will constitute a breach of contract rendering the ticket null and void, so that all rights evidenced by the ticket are extinguished. Applicants for tickets indicate agreement to these terms and conditions when submitting ticket application forms and the condition is printed on the tickets themselves. The terms on which tickets are supplied also include a condition that the ticket remains the property of the RFU at all times.

4. Consolidated Information Systems Limited, a firm in liquidation, was formerly known as Viagogo Limited (Viagogo). Viagogo operated a website which provided the opportunity for visitors to the site to buy tickets online for a number of different sporting and other events at various venues. Included among these were tickets for rugby matches at Twickenham. The way in which these transactions took place was that prospective sellers of tickets could use the website to register tickets that they intended to sell and interested purchasers could then

buy the tickets from those who wished to sell them. The website provided a means by which persons were able anonymously to sell event tickets at the going market price. A price based on “current market data” was suggested by Viagogo’s website to potential sellers when they registered a ticket for sale. Viagogo received a percentage of the price paid for the ticket.

5. The website carried a privacy policy. This was accessed through a link at the bottom of the website page. It was accompanied by the words, “Use of this website constitutes acceptance of the Terms and Conditions and Privacy Policy”. The privacy policy was also brought to the attention of a prospective seller when he registered on the site.

The steps taken by the RFU to protect its policy

6. The RFU contends that arguable wrongs are involved in the advertisement and sale of tickets at above face value through the website. The sale of tickets at above face value, it is argued, impinges directly on the RFU’s policy of promoting the sport of rugby by allowing tickets to be sold at affordable prices. It is no longer disputed that the sale of tickets in the manner facilitated by Viagogo’s website arguably constitutes an actionable wrong.

7. Previously, the RFU has sought injunctions against ticket touts and unlicensed corporate hospitality providers who were selling tickets in breach of the conditions on which tickets had been supplied. It has also taken disciplinary action against clubs that had distributed tickets other than as stipulated by the conditions. In order to take these actions, of course, the RFU had to discover the identity of the individuals or clubs involved in the sale of the tickets. It engaged in a system of monitoring the websites of secondary sellers of tickets in an attempt to discover whether tickets were being sold above face value and, if so, by whom. This effort was frustrated in many instances, however, because of the anonymity offered by websites including that of Viagogo.

8. In the run-up to the autumn international rugby matches in 2010 and the home matches for the six-nations tournament in 2011, the RFU not only continued to monitor websites, including Viagogo’s, it also conducted a series of test purchases from the Viagogo website. It discovered that Viagogo had been used to advertise thousands of tickets for the seven games that were to be played at Twickenham. Tickets with a face value of £20 to £55 were being advertised for sale at up to some £1,300. Blocks of tickets up to 24 were offered for sale.
9. On making these discoveries, the RFU’s legal advisers wrote to Viagogo seeking information about the identity of those involved in the sale and purchase of the tickets. This was resisted. The RFU therefore issued proceedings seeking the disclosure of the information which it considered was required in order to take the action that it considered was necessary to protect its policy in relation to the sale of the tickets.

The proceedings

10. On 21 March 2011 the RFU issued proceedings seeking disclosure, under the Norwich Pharmacal principles, of the identity of those who had advertised for sale or sold tickets for the autumn international and six nations matches. Tugendhat J acceded to the application, finding that there was a good arguable case that those who had received tickets from the RFU and the subsequent sellers and buyers of the tickets had been guilty of breach of contract and/or conversion [2011] EWHC 764 (QB). He also held that those who entered the stadium by use of a ticket obtained in contravention of RFU conditions were arguably guilty of trespass. The judge found that the RFU was seeking redress for these arguable wrongs by obtaining the order that it had applied for; that the information was necessary to achieve that redress; and that it was appropriate to exercise his discretion to grant the relief sought.

11. Viagogo appealed the judge’s order. A short time before the hearing of the appeal, it sought and was granted leave to introduce a new ground for resisting the grant of a Norwich Pharmacal order. This was to the effect that the making of such an order would constitute an unnecessary and disproportionate interference with the rights of those who, arguably, were wrongdoers. Those rights derived from article 8 of the Charter of Fundamental Rights of the European Union which guarantees the protection of personal data.

12. The Court of Appeal dismissed Viagogo’s appeal [2011] EWCA Civ 1585. It confirmed the findings of Tugendhat J that the RFU had an arguable case on the ground of breach of contract and trespass. It decided that the RFU had no readily available alternative means of discovering who the possible wrongdoers were other than by means of a Norwich Pharmacal order. On the argument that such an order would constitute unacceptable interference with the personal data rights of those involved in the sale and purchase of the tickets, the Court of Appeal held that such interference as would be involved by the issue of the order was proportionate in light of the RFU’s legitimate objective in obtaining redress for the arguable wrongs.
13. Before this court, the appellant’s argument was effectively confined to the claim that the grant of the order would involve a breach of article 8 of the Charter.

The Norwich Pharmacal order

14. The jurisdiction to allow a prospective claimant to obtain information in order to seek redress for an arguable wrong was recognised by the House of Lords in Norwich Pharmacal Co v Customs and Excise Commissioners [1974] AC 133. Its scope was described by Lord Reid at p 175:

“… if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrong-doing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers. I do not think that it matters whether he became so mixed up by voluntary action on his part or because it was his duty to do what he did. It may be that if this causes him expense the person seeking the information ought to reimburse him. But justice requires that he should co-operate in righting the wrong if he unwittingly facilitated its perpetration.”

15. Later cases have emphasised the need for flexibility and discretion in considering whether the remedy should be granted: Ashworth Hospital Authority v MGN Ltd [2002] 1 WLR 2033, para 57 per Lord Woolf CJ; Koo Golden East Mongolia v Bank of Nova Scotia [2008] QB 717, paras 37-38 per Lord Clarke MR. It is not necessary that an applicant intends to bring legal proceedings in respect of the arguable wrong; any form of redress (for example disciplinary action or the dismissal of an employee) will suffice to ground an application for the order: British Steel Corporation v Granada Television Ltd [1981] AC 1096, 1200 per Lord Fraser of Tullybelton.

16. The need to order disclosure will be found to exist only if it is a “necessary and proportionate response in all the circumstances”: Ashworth at paras 36, 57 per Lord Woolf CJ. The test of necessity does not require the remedy to be one of last resort: R (Mohamed) v Secretary of State for Foreign and Commonwealth Affairs (No 1) [2009] 1 WLR 2579, para 94.

17. The essential purpose of the remedy is to do justice. This involves the exercise of discretion by a careful and fair weighing of all relevant factors. Various factors have been identified in the authorities as relevant. These include: (i) the strength of the possible cause of action contemplated by the applicant for the

order: Norwich Pharmacal at p 199F-G per Lord Cross of Chelsea, Totalise plc v The Motley Fool Ltd [2001] EMLR 750 at first instance para 27 per Owen J, Clift v Clarke [2011] EWHC 1164 (QB) paras 14, 38 per Sharp J; (ii) the strong public interest in allowing an applicant to vindicate his legal rights: British Steel at 1175C-D per Lord Wilberforce, Norwich Pharmacal at p 182C-D per Lord Morris of Borth-y-Gest, 188E-F per Viscount Dilhorne; (iii) whether the making of the order will deter similar wrongdoing in the future: Ashworth at para 66 per Lord Woolf CJ; (iv) whether the information could be obtained from another source: Norwich Pharmacal at 199F-G per Lord Cross, Totalise plc at para 27, President of the State of Equatorial Guinea v Royal Bank of Scotland International [2006] UKPC 7 at para 16 per Lord Bingham of Cornhill; (v) whether the respondent to the application knew or ought to have known that he was facilitating arguable wrongdoing: British Steel per Lord Fraser at 1197A-B, or was himself a joint tortfeasor, X Ltd   v Morgan-Grampian (Publishers) Ltd [1991] 1 AC 1, 54 per Lord Lowry; (vi) whether the order might reveal the names of innocent persons as well as wrongdoers, and if so whether such innocent persons will suffer any harm as a result: Norwich Pharmacal at 176B-C per Lord Reid; Alfred Crompton Amusement Machines Ltd v Customs and Excise Commissioners (No 2) [1974] AC 405, 434 per Lord Cross; (vii) the degree of confidentiality of the information sought: Norwich Pharmacal at 190E-F per Viscount Dilhorne; (viii) the privacy rights under article 8 of the European Convention for the Protection of Human Rights and Fundamental Freedoms of the individuals whose identity is to be disclosed: Totalise plc at para 28; (ix) the rights and freedoms under the EU data protection regime of the individuals whose identity is to be disclosed: Totalise plc v The Motley Fool Ltd at paras 18-21 per Owen J; (x) the public interest in maintaining the confidentiality of journalistic sources, as recognised in section 10 of the Contempt of Court Act 1981 and article 10 ECHR: Ashworth at para 2 per Lord Slynn of Hadley.

18. Many of these factors are self-evidently relevant to the question of whether the issue of a Norwich Pharmacal order is proportionate in the context of article 8 of the Charter.

The Data Protection Directive

19. The principal instrument of the EU data protection regime is Directive 95/46/EC (the Directive). Article 1(1) of the Directive provides:

“In accordance with this Directive, Member States shall protect the fundamental rights and freedoms of natural persons, and in particular their right to privacy with respect to the processing of personal data.”

20. Article 6 of the Directive requires that Member States should make provision to ensure that personal data is processed fairly and lawfully. The concept of “processing” is wide. The regime enacted by the Directive thus applies to electronic databases as well as hard copy – article 3(1).

21. Article 7 of the Directive prescribes criteria for making data processing legitimate, stating in relevant part:

“Member States shall provide that personal data may be processed only if:

1. the data subject has unambiguously given his consent; or …

(c) processing is necessary for compliance with a legal obligation to which the controller is subject; or …

6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by the third party or parties to whom the data are disclosed, except where such interests are overridden by the interests for fundamental rights and freedoms of the data subject which require protection under Article 1(1).”

22. Article 13 of the Directive deals with exemptions and restrictions. The relevant provisions for present purposes are these:

“(1) Member States may adopt legislative measures to restrict the scope of the obligations and rights provided for in Articles 6(1), 10, 11(1), 12 and 21 when such a restriction constitutes a necessary measure to safeguard …

7. the protection … of the rights and freedoms of others”

23. In Case C-275/06 Productores de Musica de Espana (Promusicae) v Telefonica de Espana SAU [2008] 2 C.M.L.R. 465, para 53 the Court of Justice of the European Union (“CJEU”) held that the provisions of article 13, as referred to in article 15(1) of Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector ([2002] OJ L201/37) must be interpreted as “expressing the Community legislature’s intention not to exclude from their scope the protection of the right to property or

situations in which authors seek to obtain that protection in civil proceedings”. From this it is clear that it is open to member states to make provision in domestic legislation that there should be disclosure of personal data in civil proceedings, where that is necessary to enable a person with a viable cause of action to pursue it in the courts.

The Data Protection Act 1998

24. The United Kingdom implemented the Directive by the Data Protection Act 1998. Relying on article 13(1)(g) of the Directive the government chose to exempt from the nondisclosure provisions all disclosures of personal data which were required by law or made in connection with legal proceedings. The relevant section of the 1998 Act is section 35, which provides:

“(1) Personal data are exempt from the non-disclosure provisions where the disclosure is required by or under any enactment, by any rule of law or by the order of a court.

2. Personal data are exempt from the non-disclosure provisions where the disclosure is necessary-

1. for the purpose of or in connection with, any legal proceedings (including prospective legal proceedings), or

2. for the purpose of obtaining legal advice,

or is otherwise necessary for the purposes of establishing, exercising or defending legal rights.”

25. Before a Court makes an order requiring disclosure of personal data, which would attract the exemption under section 35(1), it must first take into account and weigh in the balance the right to privacy with respect to the processing of personal data which is protected by article 1(1) of the Directive: Totalise plc v The Motley Fool Ltd [2002] 1 WLR 1233 in the Court of Appeal at para 24 per Aldous LJ.

The Charter

26. The European Charter was proclaimed by the European Parliament, Council and Commission at Nice in December 2000. Its purpose was expressed to be the assembly in a single instrument of those fundamental rights which European Union law had previously identified in legislation or in decisions of the CJEU. In its initial incarnation the Charter had persuasive value: the CJEU referred to and was guided by it (see, for instance, Promusicae at paras 61-70).

27. The Charter was given direct effect by the adoption of the Lisbon Treaty in December 2009 and the consequential changes to the founding treaties of the EU which then occurred. Article 6(1) of the Treaty on European Union (TEU) now provides:

“The Union recognises the rights, freedoms and principles set out in the Charter of Fundamental Rights of the European Union of 7 December 2000, as adapted at Strasbourg, on 12 December 2007, which shall have the same legal value as the Treaties.

The provisions of the Charter shall not extend in any way the competences of the Union as defined in the Treaties.

The rights, freedoms and principles in the Charter shall be interpreted in accordance with the general provisions in Title VII of the Charter governing its interpretation and application and with due regard to the explanations referred to in the Charter, that set out the sources of those provisions.”

28. Although the Charter thus has direct effect in national law, it only binds member states when they are implementing EU law – article 51(1). But the rubric, “implementing EU law” is to be interpreted broadly and, in effect, means whenever a member state is acting “within the material scope of EU law”: see e.g. R (Zagorski) v Secretary of State for Business, Innovation and Skills [2011] HRLR 6 140, paras 66-71 per Lloyd Jones J. Moreover, article 6(1) of TEU requires that the Charter must be interpreted with “due regard” to the explanations that it contains.

29. Article 8 of the Charter provides:-

“1. Everyone has the right to the protection of personal data concerning him or her;

2. Such data must be processed fairly for specified purposes and on the basis of the consent of the person concerned or some other legitimate basis laid down by law …”

30. The relevant explanation about article 8 and to which regard must be had is in the following terms:

“This Article has been based on Article 286 of the Treaty establishing the European Community and Directive 95/46/EC of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data and on the free movement of such data … Reference is also made to Regulation (EC) No 45/2001 of the European Parliament and of the Council on the protection of individuals with regard to the processing of personal data by the Community institutions and bodies and on the free movement of such data … The above mentioned Directive and Regulation contain conditions and limitations for the exercise of the right to the protection of personal data.”

31. Article 52(1) of the Charter sets out the circumstances in which an interference with the rights expressed in the Charter may be justified:

“Any limitation on the exercise of the rights and freedoms recognised by this Charter must be provided for by law and respect the essence of those rights and freedoms. Subject to the principle of proportionality, limitations may be made only if they are necessary and genuinely meet objectives of general interest recognised by the Union or the need to protect the rights and freedoms of others.”

The appeal

32. The RFU accepts that the High Court, when making the order, can be regarded as “implementing Union law”. Since article 2(a) of the Directive defines “personal data” as meaning “any information relating to an identified or identifiable natural person (‘data subject’)”, the names and addresses of individuals covered by the order qualify as “personal data” under this definition. That being so, the order of the High Court involved the disclosure of personal data and was thus within the material scope of EU law.
33. The appellant’s challenge to the Court of Appeal’s decision rests exclusively on the claim that it applied the wrong test in assessing the proportionality of the making of the Norwich Pharmacal order. Put succinctly, the appellant claims that, in assessing whether the order is proportionate, the court should evaluate the impact that the disclosure of the information will have on the individual concerned against the value to the applicant of the information that can be obtained about that particular individual. Expressed in simple terms which reflect the circumstances of this case, the court, according to the appellant, should confine its consideration to the individual transaction and ask, “What value will the information about this particular individual have to the RFU?”

34. Mr Howe QC, who appeared for the appellant, submitted that Longmore LJ in the Court of Appeal had been wrong to suggest that it would “generally be proportionate” to make a Norwich Pharmacal order once it had been shown that there was arguable wrongdoing and that there was no realistic way of discovering the identity of the arguable wrongdoers other than by obtaining an order. Rather, Mr Howe claimed, the court should have asked whether obtaining information about a particular person who had sold a ticket at more than face value would benefit the RFU to an extent that outweighed that individual’s right to have his or her personal data protected from disclosure. It was suggested that the way in which the Court of Appeal had formulated the test involved a presumptive approach. On that basis it was to be assumed that the need to obtain the information in order to prosecute an action to vindicate the right to property would in virtually every instance trump any claim to privacy and protection of personal data. The appellant contended that this assumption was misplaced. The proportionality of the interference could only be assessed by concentrating the examination on the particular circumstances of the individual transaction. In this way, the appellant claimed, the weighing exercise involved assessing how much benefit would derive from obtaining information about a single individual as against the infringement of that particular person’s right to have his or her personal data protected.

35. In advancing this case Mr Howe relied first on the Promusicae case and in particular paras 65-70 of the CJEU’s judgment in that case:

“65 The present reference for a preliminary ruling thus raises the question of the need to reconcile the requirements of the protection of different fundamental rights, namely the right to respect for private life on the one hand and the rights to protection of property and to an effective remedy on the other.

66. The mechanisms allowing those different rights and interests to be balanced are contained, first, in Directive 2002/58 itself, in that it provides for rules which determine in what circumstances and to

what extent the processing of personal data is lawful and what safeguards must be provided for, and in the three directives mentioned by the national court, which reserve the cases in which the measures adopted to protect the rights they regulate affect the protection of personal data. Secondly, they result from the adoption by the Member States of national provisions transposing those directives and their application by the national authorities (see, to that effect, with reference to Directive 95/46, Lindqvist at [82]).

67. As to those directives, their provisions are relatively general, since they have to be applied to a large number of different situations which may arise in any of the Member States. They therefore logically include rules which leave the Member States with the necessary discretion to define transposition measures which may be adapted to the various situations possible (see, to that effect, Lindqvist at [84]).

68. That being so, the Member States must, when transposing the directives mentioned above, take care to rely on an interpretation of the directives which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality (see, to that effect, Lindqvist at [87]; and Ordre des Barreaux Francophones and Germanophone v Conseil des Ministres (C-305/05) [2007] 3

C.M.L.R. 28 at [28]).

69. Moreover, it should be recalled here that the Community legislature expressly required, in accordance with Art.15(1) of Directive 2002/58, that the measures referred to in that paragraph be adopted by the Member States in compliance with the general principles of Community law, including those mentioned in Art.6(1) and (2) TEU.

70. In the light of all the foregoing, the answer to the national court’s question must be that Directives 2000/31, 2001/29, 2004/48 and 2002/58 do not require the Member States to lay down, in a situation such as that in the main proceedings, an obligation to communicate

personal data in order to ensure effective protection of copyright in the context of civil proceedings. However, Community law requires that, when transposing those directives, the Member States take care to rely on an interpretation of them which allows a fair balance to be struck between the various fundamental rights protected by the Community legal order. Further, when implementing the measures transposing those directives, the authorities and courts of the Member States must not only interpret their national law in a manner consistent with those directives but also make sure that they do not rely on an interpretation of them which would be in conflict with those fundamental rights or with the other general principles of Community law, such as the principle of proportionality.”

36. Mr Howe suggested that in these passages the CJEU had prescribed a clear principle that national courts, in dealing with a claim for disclosure of personal data must weigh the potential value to the party seeking the material against the interests of the data subject. This unexceptionable claim can be readily accepted; it is its refinement and development that causes greater difficulty. Mr Howe argues that in making that assessment, the court must conduct the examination solely by reference to the particular benefit that obtaining the information relating to an individual data subject might bring. Its value as part of a broader context is not to be considered. Thus, for instance, the fact that obtaining the information might deter others from selling or buying tickets for rugby internationals could not be taken into account.

37. I find this approach somewhat artificial, not to say contrived. It is unrealistic to fail to have regard to the overall aim of the RFU in seeking this information. It is not simply to pursue individuals. It obviously includes an element of active discouragement to others who might in the future contemplate the flouting of rules which the RFU seeks to enforce. There is nothing, in my opinion, in the cited passages from the CJEU’s judgment that supports a restriction of the matters to be considered by a national court in the manner suggested.

38. It was submitted, however, that the later case of C/461-10 Bonnier Audio AB v Perfect Communication Sweden AB made it even clearer that the inquiry as to proportionality was directed to the particular facts of each case and that, in consequence, broader considerations, extending beyond the specific circumstances of the data subject, were not to be taken into account. In the Bonnier Audio case the applicants were publishing companies holding exclusive rights to the reproduction, publishing and distribution to the public of works in the form of audio books. They claimed that their exclusive rights had been infringed by the public distribution of the works without their consent by means of a file transport protocol server which allowed file sharing and data transfer between computers connected to the internet. The applicants applied to a district court for an order for

disclosure of data for the purpose of communicating the name and address of the person using the IP address from which it was assumed that the files in question had been sent. In that case the national measure under consideration permitted an internet service provider to be ordered to give a copyright holder information on the subscriber to whom the internet service provider had supplied a specific IP address which was used in the infringement of the copyright. The principal issue for the CJEU was whether this was precluded by Directive 2006/24.

39. Particular reliance was placed on paras 59 and 60 of the judgment of the CJEU:

“59 Thus [the Swedish domestic legislation] enables the national court seised of an application for disclosure of personal data, made by a person who is entitled to act, to weigh the conflicting interests involved, on the basis of the facts of each case and taking due account of the requirements of the principle of proportionality.

60 In those circumstances, such legislation must be regarded as likely, in principle, to ensure a fair balance between the protection of intellectual property rights enjoyed by copyright holders and the protection of personal data enjoyed by internet subscribers or users.”

40. Mr Howe suggested that the use of the expression, “the facts of each case” in para 59 of the court’s judgment betokened a conclusion that the individual transaction between the internet provider and the subscriber was to be considered without reference to broader considerations that might motivate the applicant for disclosure of the information. I do not accept that submission. Of course the facts of each case must be considered. But this does not mean that they should be placed in a hermetically sealed compartment so that their possible impact on issues going well beyond their significance to the person whose personal data are sought is ignored. There is no logical or sensible reason to disregard the wider context in which the RFU wants to have access to this information. Their desire to prevent the future sale of tickets for international matches at inflated prices is intimately connected to the application for the Norwich Pharmacal order. The ability to demonstrate that those who contemplate such sale or purchase can be detected is a perfectly legitimate aspiration justifying the disclosure of the information sought. There is no coherent or rational reason that it should not feature in any assessment of the proportionality of the granting of the order.

41. Mr Howe referred finally to the case of Goldeneye (International) Ltd v Telefonica UK Ltd [2012] EWHC 723 (Ch). In that case Golden Eye and 13 other claimants sought a Norwich Pharmacal order against Telefonica UK Ltd trading as

O2, one of the six largest retail internet service providers in the UK. The object of the claim was to obtain disclosure of the names and addresses of customers of O2 who were alleged to have committed infringements of copyright through peer-to- peer file sharing.

42. At paras 118 and 119 Arnold J set out the respective rights of the claimants and those whose personal data would be disclosed if a Norwich Pharmacal order was made:

“The Claimants’ rights

118. The Claimants’ position can be summarised as follows. They are owners of copyrights which have been infringed on a substantial scale by individuals who have been engaged in … file sharing. The only way in which they can ascertain the identity of those individuals and seek compensation for past infringements is by (i) obtaining disclosure of the names and addresses of the Intended Defendants,

(ii) writing letters of claim to the Intended Defendants seeking voluntary settlements and (iii) where it is cost-effective to do so, bringing proceedings for infringement.

The Intended Defendants’ rights

119. The Intended Defendants are not, of course, before me. With the assistance of Consumer Focus’ submissions, however, it seems to me that the position of the Intended Defendants can be summarised as follows. It is likely that most of the Intended Defendants are ordinary consumers, many of whom may be on low incomes and without ready access to legal advice, particularly specialised legal advice of the kind required for a claim of this nature. The grant of the order sought will invade their privacy and impinge upon their data protection rights. Furthermore, it will expose them to receiving letters of claim and may expose them to proceedings for infringement in circumstances where they may not be guilty of infringement, where the subject matter of the claim may cause them embarrassment, where a proper defence to the claim would require specialised legal advice that they may not be able to afford and where they may not consider it cost-effective for them to defend the claim even if they are innocent.”
120. The situation in the Goldeneye case can be readily distinguished from the present case. There, unwitting customers of O2 might find themselves identified as possible downloaders of pornography and demands made of them for payment of the service. As was pointed out during argument on this appeal, some customers who had not engaged at all in downloading the material might feel constrained to make the payment demanded in order to avoid the embarrassment of being accused of that activity. In the present case, by contrast, all that is sought is the names and addresses of persons who have sold or bought tickets for international rugby matches in contravention of unambiguously stated rules that they should not do so.

44. Mr Howe commended the test adumbrated by Arnold J in para 117 of his judgment as follows:

“In my judgment the correct approach to considering proportionality can be summarised in the following propositions. First, the Claimants’ copyrights are property rights protected by Article 1 of the First Protocol to the ECHR and intellectual property rights within Article 17(2) of the Charter. Secondly, the right to privacy under Article 8(1) ECHR/Article 7 of the Charter and the right to the protection of personal data under Article 8 of the Charter are engaged by the present claim. Thirdly, the Claimants’ copyrights are ‘rights of others’ within Article 8(2) ECHR/Article 52(1) of the Charter. Fourthly, the approach laid down by Lord Steyn where both Article 8 and Article 10 ECHR rights are involved in In re S [2004] UKHL 47, [2005] 1 AC 593 para 17 is also applicable where a balance falls to be struck between Article 1 of the First Protocol/Article 17(2) of the Charter on the one hand and Article 8 ECHR/Article 7 of the Charter and Article 8 of the Charter on the other hand. That approach is as follows: (i) neither Article as such has precedence over the other; (ii) where the values under the two Articles are in conflict, an intense focus on the comparative importance of the specific rights being claimed in the individual case is necessary; (iii) the justifications for interfering with or restricting each right must be taken into account; (iv) finally, the proportionality test – or ‘ultimate balancing test’ – must be applied to each.”

45. I have no difficulty in accepting this as a correct statement of the approach to the question of proportionality in the Norwich Pharmacal context. But I do not accept that its application to the present appeal leads to the conclusion that the order should not be granted. An “intense focus” on the rights being claimed in individual cases does not lead to the conclusion that the individuals who will be affected by the grant of the order will have been unfairly or oppressively treated. On the contrary, all that will be revealed is the identity of those who have, apparently, engaged in the sale and purchase of tickets in stark breach of the terms

on which those tickets have been supplied by the RFU. The entirely worthy motive of the RFU in seeking to maintain the price of tickets at a reasonable level not only promotes the sport of rugby, it is in the interests of all those members of the public who wish to avail of the chance to attend international matches. The only possible outcome of the weighing exercise in this case, in my view, is in favour of the grant of the order sought.

46. In suggesting that it would “generally be proportionate” to make an order where it had been shown that there was arguable wrongdoing and there was no other means of discovering the identity of the arguable wrongdoers, Longmore LJ might be said to have somewhat overstated the position, although it is to be noted that this was not expressed as a presumption in favour of the grant of an order. The particular circumstances affecting the individual whose personal data will be revealed on foot of a Norwich Pharmacal order will always call for close consideration and these may, in some limited instances, displace the interests of the applicant for the disclosure of the information even where there is no immediately feasible alternative way in which the necessary information can be obtained. But, in the present case, the impact that can reasonably be apprehended on the individuals whose personal data are sought is simply not of the type that could possibly offset the interests of the RFU in obtaining that information. I would therefore dismiss the appeal.

Consent

47. Lord Pannick QC, who appeared for the RFU, deployed, as an alternative to the claim that the grant of the Norwich Pharmacal order was proportionate, the argument that the persons whose personal data were sought had given their consent to the disclosure of that information. In light of my conclusion as to the proportionality of the order, it is not strictly necessary to deal with this argument. It can, in any event, be disposed of briefly. Article 7(a) of the Directive provides that member states must provide that personal data may be processed if the data subject has given his unambiguous consent to its disclosure. Article 2(h) defines ‘consent’ for this purpose. It provides that “‘the data subject’s consent’ shall mean any freely given, specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”.

48. As part of the registration process a visitor to the Viagogo website was informed that use of the website constituted acceptance of the terms of the privacy policy referred to in para 5 above. A condition of registration was agreement to the Viagogo terms and conditions and the privacy policy. The privacy policy contains the following statement:

“You should be aware that in addition to the circumstances described above, Viagogo may disclose your financial or personal information if required to do so by law, court order, as requested by other government or law enforcement authority, or in the good faith belief that disclosure is otherwise necessary or advisable including, without limitation, to protect the rights or properties of Viagogo or its affiliated companies or when we have reason to believe that disclosing the information is necessary to identify, contact or bring legal action against someone who may be causing interference with our rights or properties, whether intentionally or otherwise, or when anyone else could be harmed by such activities.”

49. Lord Pannick suggested that this constituted an unambiguous consent sufficient to satisfy the requirements of articles 2(h) and 7(a). Even if the disclosure was disproportionate, therefore, by accepting Viagogo’s terms and conditions, the data subject had given unequivocal consent to the disclosure of his or her personal data.

50. The short – but, in my view, conclusive – answer to this argument is that such consent as may have been given by acceptance of the terms and conditions did not include an agreement to disclose personal data other than when it was proportionate to do so. Viagogo could not be required by law to disclose personal data other than when it was concluded that it was proportionate to require it to do so. A court order requiring its disclosure could not be made without the necessary underpinning of proportionality. It follows that the person who registered on the Viagogo website consented – at most – to the disclosure of his or her personal data when it was established that this was a proportionate response to a request for its release. In my view, therefore, RFU’s alternative argument based on consent must be rejected. It should be made clear, however, that the argument based on consent was, in the manner of its presentation, very much subsidiary to the principal submissions on the proportionality of the order, and my conclusions on it are, on that account, entirely incidental to the primary findings on the appeal.