Hughes v Carratu International Plc

On 24^th March 2006 the Claimant received a letter from the Information Commissioners Office (“ICO”). It included the following:

“… I am dealing with a company who have breached the Data Protection Act 1998.

I have some documents which were seized during the execution of a search warrant, which I would like to show you. These documents concern transactions on your bank accounts.

This is a criminal offence under Section 55 of the Data Protection Act 1998 and we will be pursuing a prosecution in this case. …”

The Applicant was subsequently informed by the ICO that the subject of the search warrant was an enquiry agent, but not the name of the enquiry agent. The ICO provided him with copies of some of the documents seized. He pursued enquiries through his solicitors, but the ICO stated that they were not able to disclose either the identity of the enquiry agent or the identity of those instructing the enquiry agent.

When the Applicant attended the offices of the ICO on 21^st April 2006, in order to provide a witness statement in support of their intended prosecution of the enquiry agent, he was shown certain documents. These were documents found on his file during the search of the enquiry agent’s premises. The documents included notes containing details of all his bank accounts including details of his personal financial information. At this meeting he was also informed that another client of his solicitors had been investigated by the same enquiry agent and that his file was also seized by the ICO.

One of the documents seen by the Applicant had written on it, apparently by the enquiry agent, the name of the Respondent. The Respondent is a corporate investigation consultancy offering investigative services.

By letter dated 15^th May 2006 the Applicant’s solicitors wrote to the Respondent requesting the identity of the party for whom the Respondent were acting in instructing the enquiry agent to carry out searches relating to the Applicant. There followed an exchange of correspondence which the Applicant regarded as obstructive and unhelpful conduct on behalf of the Respondent.

On 5^th June 2006 the Applicant issued this Application Notice. By it he seeks an order that the Respondent disclose all documents currently in its possession or control, or previously but no longer in its possession or control, including, but not limited to documents relating to his personal financial affairs, and disclosing the identity of the party or parties on whose behalf or on whose instructions the information concerning the Applicant was gathered and disclosing the identity of the party or parties by whom the information concerning the applicant was gathered.

In the Notice it is stated that the application is made pursuant to CPR 25.1(1) (i), alternatively CPR 31.16. Shortly before the hearing it was made known on behalf of the Applicant that the application would also be advanced on the basis of the Norwich Pharmacal principle which is preserved by CPR 31.18. The principle as originally formulated is that if through no fault of his own a person gets mixed up in the tortious acts of others so as to facilitate their wrongdoing he may incur no personal liability but he comes under a duty to assist the person who has been wronged by giving him full information and disclosing the identity of the wrongdoers. For the purpose of that principle it has since become established that tortious acts include acts which may not be strictly speaking torts but includes any civil or criminal wrong: see Ashworth Hospital Authority v. MGN Ltd [2002] UKHL 29: [2002] 1 WLR 2033.

The provisions of CPR31.16 are as follows:

“(1)

This rule applies where an application is made to the court under any Act for disclosure before proceedings have started.

(2)

The application must be supported by evidence.

(3)

The court may make an order under this rule only where –

(a)

the respondent is likely to be a party to subsequent proceedings;

(b)

the applicant is also likely to be a party to those proceedings;

(c)

if proceedings had started, the respondent’s duty by way of standard disclosure, set out in rule 31.6, would extend to the documents or classes of documents of which the applicant seeks disclosure; and

(d)

disclosure before proceedings have started is desirable in order to –

(i)

dispose fairly of the anticipated proceedings;

(ii)

assist the dispute to be resolved without proceedings; or

(iii)

save costs.

(4)

An order under this rule must –

(a)

specify the documents or the classes of documents which the respondent must disclose; and

(b)

require him, when making disclosure, to specify any of those documents –

(i)

which are no longer in his control; or

(ii)

in respect of which he claims a right or duty to withhold inspection.

(5)

Such an order may –

(a)

require the respondent to indicate what has happened to any documents which are no longer in his control; and

(b)

specify the time and place for disclosure and inspection.”

When the matter came before me on 12^th July the Respondent did not accept that an order should be made disclosing the identity of the enquiry agent, but neither did they oppose it. I made that order. What remained in dispute was whether the identity of the person instructing the enquiry agent should be disclosed and whether any order should be made in relation to the documents sought from the Respondent. I reserved my judgment upon that point.

In a witness statement dated 30^th June 2006 Mr Paul Carratu, the Managing Director of the Respondent, described his business and his qualifications. The Respondent has for some 30 years specialised in the investigation of intellectual property fraud and other investigations. He is a Fellow of the Institute of Professional Investigators and has qualified as a Certified Fraud Examiner among other qualifications. He stated:

“I can confirm that together with our client we have conducted a detailed but careful review of our entire file on this matter and can confirm that it contains no documents containing or in any way referring to information concerning [the Applicant] which has been obtained unlawfully.

Our client in this matter is a well respected London law firm and they have requested that we return the entire content of our file, prior to the most recent correspondence with [the Applicant’s solicitors] to them in order that they may protect their client’s legal privilege. As such, there are no longer any documents in our possession which relate to [the Applicant].

To the extent that the issue of privilege is challenged it will be necessary to deal with our client directly as it is their client’s privilege, not ours that is being claimed.

I can also confirm that at no time did [the Respondent] or our client instruct any person to obtain or procure information concerning [the Applicant’s] personal finances in any unlawful way”.

The reference to the client’s privilege is unhelpful. Insofar as the client is identified as a law firm, which may be presumed to be acting on behalf of a lay client, the privilege would be that of the lay client. But neither of the law firm nor the lay client is identified. Neither of them has advanced a claim for privilege, at least in a form which has been communicated to the court.

On 11^th July 2006 the day before the hearing, Mr Carratu made a second witness statement. In it he states that the instructions given by the law firm to the Respondent and by the Respondent to the agent related solely to obtaining information in the public domain. He says they were asked by the law firm to conduct an asset search relating to the Applicant and any companies owned by him. He states that the Respondent often sub-contracts some or all of the work they are instructed to do to agents. He continues as follows:

“4.

I am well aware that it is unlawful to obtain information as to individual’s bank accounts. My staff are also aware of this, since I give them full instructions on what activities are or are not unlawful. I now know personally (as a result of the enquiries explained below) precisely what instructions were received from our client and what instructions were provided to the agent concerned. I can categorically state that Carratu did not instruct the agent in this case to do so, and neither did Carratu’s client instruct us to do so. Had we received such instructions from any client we would have declined them. Carratu has an excellent reputation amongst law firms as the Corporate Investigation Agency of choice and we would not do anything to jeopardise that reputation by involving ourselves in illegal activities.

5.

In this case we did receive an unsolicited facsimile from our agent containing the bank account details appended to [the Applicant’s] witness statement in this matter. The Carratu employee who received the facsimile immediately realised that the information must have been obtained unlawfully and shredded it. The information was not retained in any form by Carratu and was not passed on to our client. I have since spoken to the agent in question and made it clear that Carratu does not wish to receive information of this nature. I have only become aware of the investigation by the Information Commissioner as a result of this application and Carratu has not been contacted by either the Information Commissioner’s office or the police.

6.

When I received [the solicitor’s] first letter in this matter, I spoke to the employee responsible for this work and discussed it with him. He had never seen any details relating to [the Applicant’s] bank accounts and had not referred to them in his report, and we did not understand what [the solicitors] were referring to. It is only when I received the papers appended to [the Applicant’s] witness statement that we had a full understanding of what the matter related to. We conducted an internal investigation and it emerged that the bank account information had been received whilst the employee principally responsible was on holiday. A colleague of his had received the fax and destroyed it immediately, hence this was not discovered on our initial check on receipt of [the solicitor’s] first letter”.

The statement goes on to refer to a confidentiality clause in the Respondent’s conditions of business and states that the Respondent is therefore unable voluntarily to comply with the Applicants request but should the Court see fit to make an order for disclosure then the Respondent would comply with it.

In earlier letters dated 19^th and 20^th May 2006 the Respondent had stated that it shredded all case files after six months and did not admit holding a file on the Applicant. It also asserted that all information was legally obtained. It suggested that the correct approach for the Applicant was a request under the Data Protection Act 1998, s.7, but when such an application was made on 5^th June 2006 it revealed nothing.

On 5^th June 2006 the Applicant made his witness statement in support of his application. He states that he has been advised that he is entitled to bring a claim for damages for breach of privacy and misuse of confidential information and also for misuse of data under the Data Protection Act 1998. He then continues:

“21.

…However, although I know that confidential personal information belonging to me has been misused I do not know who to sue for the damages. My only option at present is to obtain disclosure of any documents relating to the illegal searches against my bank accounts and of the identity of the person who has instigated the illegal searches against me.

22.

I therefore make this application in order to ascertain the identity of those instructing Carratu to carry out illegal searches against me. …

23.I have been angered and distressed at having my privacy invaded in this way and by discovering highly confidential personal information belonging to me has been misused. At present I do not know who has obtained this information or to whom the information has been passed. Information about my bank accounts is highly sensitive and is presently in the hands of persons unknown to me without my consent and is potentially being further used or disseminated to my detriment ”.

So far as the application under CPR 31.16 is concerned, Mr Wolanski, who appeared on behalf of the Respondent, made it clear that there was only one issue. He submitted that there was no material before the court to show that the Respondent is likely to be a party to subsequent proceedings, as required by 31.16(3)(a). He specifically accepted that if he were wrong about that, then the other conditions in

The first basis for the Respondent’s submission that condition (a) was not satisfied was that in the witness statement of the Applicant it is not stated that he has an intention to sue the Respondent. What is suggested is that it is the law firm which is targeted. Miss Addy for the Applicant submits that this is an unrealistically narrow interpretation of the witness statement. However, she took instructions and informed me that her client intends to sue everyone who has done him a wrong including the Respondent. It is clear from the evidence that the Applicant is a person with the means to do that, if he wishes. Having read the correspondence and the witness statement, and taking into account the instructions which Miss Addy states that she has received about the Applicant’s intentions, I am persuaded that the condition (a) is satisfied and so that the order should in principle be made.

The second point taken by Mr Wolanski relates primarily to the Norwich Pharmacal application insofar as that relates to the law firm. But the submissions also have a bearing on the order under the CPR 31.16 and I have taken them into account in that context as well.

For the purpose of this application I can take the law to be as stated by Lightman J in Mitsui & Co Ltd v. Neeun Petrolium UK Ltd [2005] EWHC 625 (Ch); [2005]3A All ER 511 para 21:

“The three conditions to be satisfied for the court to exercise the power to order Norwich Pharmacal relief are : (i) a wrong must have been carried out or arguably carried out, by an ultimate wrongdoer; (ii) there must be the need for an order to enable action to be brought against the ultimate wrongdoer; and

(iii)

the person against whom the order is sought must: (a) be mixed up in so as to have facilitated the wrongdoing; and (b) be able or likely to be able to provide the information necessary to enable the ultimate wrongdoer to be sued”.

Mr Wolanski submits that there is no sufficient case made out of any civil or criminal wrongdoing as against either the Respondent or the law firm. He accepts that there is such a case as against the enquiry agent, and there is no dispute that the enquiry agent was instructed by the Respondent, which was itself instructed by the law firm. However, Mr Wolanski submits that the correspondence and witness statements for the Respondent contain wholly credible evidence that there has been no wrongdoing on behalf of either the Respondent or the law firm. He points to the high qualifications and long experience of Mr Carratu. Accordingly he has a great deal to lose by acting unlawfully. The evidence is that the law firm is a well respected London firm and it too has a great deal to loose by acting unlawfully. Neither the ICO nor the police have approached the Respondent in relation to this matter.

Miss Addy, on the other hand, submits that the Respondent’s declarations of proper conduct should not at this stage be taken at face value. The Respondent should be required to demonstrate them by the provision of full information, if it can. She submits that the fact that the ICO seized documents unlawfully obtained on the same occasion in respect of another client of the solicitors at the same enquiry agent’s premises can give rise to the inference that this is not a one off case but represents a course of conduct.

She submits that the fact that the enquiry agent sent the unlawfully obtained (and obviously unlawfully obtained) information by fax to the Respondent itself gives rise to inferences. It may be suggested that they would not have done this, and in the process disclosed their own criminal conduct, unless they had reason to believe that the receipt of the information would not be unwelcome. She submits that the fact that the information was immediately shredded, assuming that is what happened as the Respondent states, does not mean that the information was not used. It could have led to a train of enquiry, or provided the Respondent with the means or information necessary to obtain that or other information from another source.

Miss Addy submits that the Respondent has not been candid and that can be seen by comparing what is now accepted in the witness statement dated 12^th July 2006 compared to what was said earlier. On 19^th May 2006 the Respondent wrote that if an application were made under the subject access provisions of the Data Protection Act they would respond as quickly as possible, it referred to the policy of shredding files after six months, it referred in general terms to receiving information from a variety of sources that they may not have specifically requested, and specifically did not admit holding material relating to the Applicant. The letter stresses the Respondent’s concern that all material passed to their clients should have been legally obtained.

On 23^rd May the Respondent wrote still not admitting to holding a file on the Applicant. It suggested that it did not know who the enquiry agent concerned was saying:

“Your earlier letter states “based in the North West”. During the course of the year we deal with many agents, it would help us greatly if you could identify him/her”.

The letter refers to the possibility of proceedings against the law firm, without of course identifying the grounds.

The Applicant made his subject access request by letter dated 2^nd June 2006. This was forwarded to the Respondent under cover of a letter dated 5^th June from his solicitors. That document stated that it was sent by fax and email. On 8^th June 2006 the Respondent replied that it had not been sent by fax or email but that it had only received a copy by post on 7^th June. The Respondent took the point that the subject access request ought to have been accompanied by a payment of £10 and proof of residence by way of a utility bill. These were forwarded on 12^th June 2006.

On 30^th June 2006 the Respondent replied by letter including the following:

“We have reviewed our case file on this matter and we can confirm to you that there are no documents containing or in any way referring to information concerning your client which has been obtained unlawfully. No electronic records exist. Those documents we held are privileged in that they were prepared for dominant purpose of litigation involving your client. We have raised with our client the fact of your application. Our client has requested that we return the content of our case file in order to protect privilege. We have done this. For this reason, quite aside from the fact that you are not entitled to disclosure (on the basis that all documents are covered by privilege), we have no documents to disclose.

To the extent that you wish to challenge privilege it will be necessary for any application to involve our client as it is their client’s privilege (not ours) that will be the subject of this application. In these circumstances in light of the above we would propose that you adjourn the hearing and you confirm what your plans and intentions now are”.

It is to be recalled that the suggestion that the subject access request be made under the Data Protection Act came from the Respondent, and if the contents of that letter are correct, it was a complete waste of time (and £10), because they had no electronic records in any event. The privilege, as already noted, is that of the lay client, and in the absence of any identification of either of the law firm or the lay client, the apparent suggestion that this is an avenue that the Applicant should pursue appears disingenuous. In any event, as of today, no such claim has been made by the lay client or anyone on that person’s behalf, so far as I am aware, and the onus of applying for the protection of the privilege lies on the person claiming it.

On 7^th July 2006 the Applicant’s solicitors sent another letter on which was written that it had been received by post and fax. On 10^th July 2006 the Respondent replied saying:

“… once again we do not receive a fax from you on that date. We must assume that as this has happened on numerous occasions that it is a deliberate tactic on your part”.

This is a surprising allegation of bad faith to make against a well known law firm such as the Applicant’s solicitors, particularly given that they are acting for an Applicant who can have nothing to gain from such a tactic The solicitors have produced the transmission data. It shows the fax number appearing on the Respondent’s documents was dialled on 7 July at 13.25 and the results are recorded as ‘No Answer’. They so informed the Respondent on 10 July. The point is not addressed in the witness statement of Mr Carratu signed on 11 July 2006.

It seems to me that the correspondence and witness statements emanating from the Respondent are lacking in candour and would go very little way towards rebutting any inference that might be drawn along the lines suggested by Miss Addy.

Miss Addy also referred me to Dubai Aluminium Co Ltd v. Al Alawi [1999] 1 WLR 1999 at page 1969, in which Rix J (as he then was) set out the limits of legal professional privilege in relation to information obtained by criminal means, in that case contrary to the Data Protection Act 1984. Any claim for legal professional privilege that might be advanced by the lay client in this case may not be straightforward.

Rix J also referred to the problems that have arisen in recent years from the data protection legislation. In particular insofar as that relates to investigative agents employed by solicitors for the purpose of litigation. Rix J referred to the advice issued by the Bar Council in July 1997 headed “The Data Protection Act 1984 and the Bar” set out in Gee on Mareva injunctions and Anton Piller Relief 4^th Edition (1998) page 121. That book, now entitled Commercial Injunctions is in its 5^th Edition (2004). The 1997 guidance is set out in the 5^th edition at pages 223 -224.

The current edition of Gee also sets out (at page 224 and following) more recent advice issued by the Bar Council in 2003. It is headed “Guidance on Illegally Obtained Evidence in Civil and Family Proceedings”. What it says has as much relevance to solicitors and other professionals as it does to barristers. It starts by noting that it increasingly common for counsel to have to advise in cases where evidence has or may have been obtained illegally. It refers to the Data Protection Act 1998 section 55 and to the Dubai Aluminium case. In paragraph 8 of the document it gives the following advice.

“8… (f) There may be doubt, for whatever reason, as to whether use of the evidence is permissible or whether disclosure is required. Equally, some further apparently unlawful step may appear necessary. Clearly, no such step can be taken without the prior permission of the court. In each case counsel should consider a “without notice” application to the judge for authorisation pursuant to Section 55(2)(a)(2).

9 There are other situations apart from those involving disclosure or deployment in court, in which counsel may wish to make use of such documents in litigation. One possible example would be putting the document to a prospective witness for comment. Again, if there is any doubt as to whether such use is required or authorised pursuant to a rule of law, counsel should consider an application to the judge as in 8(f)”.

Section 55(2)(a)(2) provides that the prohibition upon knowingly or recklessly obtaining disclosing or procuring the disclosure of personal data without the consent of the data controller does not apply to a person who shows that the obtaining, disclosing or procuring was necessary for the purpose of preventing or detecting crime, or was required or authorised by or under any enactment, by any rule of law or by the order of the court, amongst other conditions. This a provision to which the Respondent referred in correspondence, but without identifying any facts relating to the present case.

The advice of the Bar Council is no more than that. It does not, (yet, at least) carry the endorsement of the court. But it illustrates how difficult the position can be for lawyers and others who receive unsolicited information that has been unlawfully obtained. It does not seem to me that the court can simply accept the assertions of the Respondent that neither it nor the law firm has acted unlawfully. The Respondent, did, eventually, admit to receiving unlawfully obtained information, and may not yet have given a full account of the matter. In these circumstances I accept that the Applicant passes the threshold test of establishing an arguable cause of action against the Respondent and the law firm.

The causes of action identified by Miss Addy are in confidence or privacy and under the Data Protection Act 1989 ss 7(9) (right of access to personal data), 14(4) (rectification and destruction), 13(1) (compensation for any contravention of the requirements of the Act) and 55. By s.4(4), it is the duty of a data controller to comply with the data protection principles in relation to all personal data with respect to which he is the data controller. The first principle (Sch 1 Part 1, para 1) is that personal data shall be processed fairly and lawfully. A data controller is defined (s.1(1)) as:

“a person who (either alone or jointly or in common with other persons) determines the purposes for which and the manner in which any persona l data are, or are to be, processed”.

In the context of information obtained by enquiry agents instructed by a solicitor, who is a data controller may be a matter for some debate, and will in any event depend on the facts of the particular case.

It is arguable that the Applicant is entitled to an order that he be provided with the names of the individuals to whom his personal information has been communicated and to an explanation as to what, if anything they have done with the information by way of use or disclosure to a third person. It is not possible at this stage to exclude the possibility that he might be entitled to some remedy by way of injunction or damages or compensation under the Data Protection Act 1998 or any other cause of action.

Further, the law, both the common law and the proper understanding of the data protection legislation, is in a state of development and the scope and implications of the legislation have not yet been extensively considered by the courts. It is difficult to say that the Applicant has no arguable claim in the present case against the Respondent and the law firm.

A further point taken by Mr Wolanski is that it is not necessary at this stage to make an order relating to the law firm. He submits that since the ICO have told the Applicant’s solicitors that the Information Commissioner will be commencing criminal proceedings against the agent it is extremely likely, if not inevitable, that the identity of the law firm will emerge during the course of those proceedings. Therefore, it is submitted, there is no need to order disclosure by the Respondent at this stage.

Miss Addy submits that the Applicant has been put to enough trouble already by the prevarication of the Respondent and it would be burdensome for the Applicant to have to make some other application in the future. It is uncertain whether or when the identity of the law firm will emerge from the criminal proceedings and the Applicant wishes to pursue his remedies, such as they may be, promptly.

I accept Miss Addy’s submissions. It seems to me that this is a case where it is apposite to refer to the words of Rix LJ in Black v. Sumitomo Corp [2002] 1 WLR 1562; [2001] EWCA Civ 1819 para 95:

“In appropriate circumstances, where the jurisdictional thresholds have been crossed, the court might be entitled to take the view that transparency would be what the interests of justice and proportionality most required”.

This is a case, where on the basis of information coming from the ICO there is reason to believe that there has been a serious breach of the criminal law. The enquiry agents who are suspected of that breach and who have been charged with it, appear to have been under the impression that the Respondent (and so presumably the Respondent’s client, the law firm), would not regard as unwelcome the receipt of the information which was obtained by those criminal means. This is not, apparently an isolated case. I infer that the law firm are aware of the present proceedings because I have been told that they asked for the file in order to protect their client’s claim to privilege, but they have not indicated any stance that they might be adopting towards the making of the order insofar as it might involve disclosure of their own identity. There has been no explanation as to how the enquiry agents can have been under so serious a misunderstanding as to the wishes of the Respondent that all information be obtained lawfully, given the Respondent’s repeated declarations of the importance they attach to compliance with the law.

For these reasons I shall make the whole of the order sought by the Applicant.