Case Law: Law Society v Kordowski, “Solicitors from Hell” shut down – Eddie Craven

The ‘Solicitors From Hell’ website has been a notorious thorn in the side of the legal profession since its inception in 2005. Despite a slew of libel actions against its founder, Rick Kordowski, the website continued to publicly vilify hundreds of solicitors and law firms. However on 15 November 2011 Mr Justice Tugendhat granted an injunction permanently closing down the website (see our post here).

On 7 December 2011, the judge gave his full reasons for making this unusual order (Law Society (and others) v Rick Kordowski [2011] EWHC 3185 (QB)). Aside from its obvious consequences for the individuals and firms listed on the website, several aspects of Tugendhat J’s judgment will be of interest to media practitioners.

First, the decision contains an interesting analysis of the interface between libel, harassment and data protection in the context of online publications. Secondly, the case involves a novel use of the representative action procedure under CPR 19.6. Thirdly, the judgment exposes important differences between the Information Commissioner and the courts about the application of the Data Protection Act 1998 to the operators of online discussion forums.

The background

The Defendant set up the Solicitors From Hell website in 2005, following a dispute with a firm of solicitors that he had instructed in various property and benefits matters. From the outset the website enabled and encouraged members of the public to publish negative comments about solicitors and other legal professionals under cover of anonymity. By 2011 the website contained over 900 separate posts and received over 1 million web hits every month. The majority of comments contained allegations of negligence, professional misconduct or criminal behaviour. Although the site presented itself as a public interest forum, there was evidence that the Defendant had attempted to extract money from some lawyers who found themselves ‘named and shamed’ on the forum.

The claim

There were three parties to the action: the Law Society, Hine Solicitors (a firm of solicitors listed on the website) and Kevin McGrath (an individual solicitor listed on the website). The claim was also brought as a representative action under CPR 19.6 on behalf of all those currently featuring on the website and those who might, in the future, feature on the website.

The Claimants sought an injunction permanently shutting down the website and prohibiting the Defendant from establishing a similar website in future. The pleaded causes of action were libel, harassment under the Protection from Harassment Act 1997 and breach of the Data Protection Act 1998.

The Defendant purported to serve a Defence out of time. The Defence disputed the Claimants’ entitlement to bring representative proceedings under CPR 19.6 and asserted an unqualified right to free expression under Article 10(1). It otherwise raised no defence to the claims in libel. In relation to the harassment and data protection claims, the defendant merely argued that the Claimants must bring those claims, if at all, under the law of libel.

Libel

Tugendhat J had little difficulty in concluding that the allegations published on the website about the Second and Third Claimants were false [132]. The words complained of were capable only of a defamatory meaning and the Defendant had no real prospect of successfully defending the libel claims on the issue of meaning [131]. The judge therefore issued a perpetual injunction prohibiting any further publication of the words complained of or any similar words defamatory of those Claimants [140].

Harassment

Section 1(1) PHA provides that a person must not pursue a ‘course of conduct’ which amounts to ‘harassment of another’. Section 1(1A) similarly prohibits a person from pursuing a course of conduct which involves harassment of two or more persons and which is intended to persuade any person (i) not to do something that he is entitled or required to do, or (ii) to do something that he is not under any obligation to do.

Harassing a person includes ‘alarming the person or causing them distress’ (s.7(2)), while ‘conduct’ for these purposes includes ‘speech’ (s.7(4)). Section 1(3) excludes from the ambit of s.1(1) and 1(1A) any course of conduct that: (a) is aimed at preventing or detecting crime; (b) is taken pursuant to any enactment or rule of law; or (c) is ‘reasonable’ in the particular circumstances of the case.

Tugendhat J had no hesitation in concluding that the Defendant’s actions in operating the Solicitors From Hell website breached the PHA:

‘It is plain that the requirements of the PHA are satisfied. Any normal person would be distressed at the course of conduct the Defendant has pursued in publishing what he has published about those solicitors. So I am satisfied that the Defendant has committed, and is threatening to continue to commit, the statutory tort of harassment, and that the victims are not only the Second and Third Claimants, but all solicitors and other lawyers named or to be named on the Website.’ [133]

In this regard, it was no defence that the words published may have been true:

‘There is no need for evidence of falsity for me to reach this conclusion. Even if there were evidence that the allegations were true, the conduct of the Defendant could still not even arguably be brought within any of the defences recognised by the PHA. No individual is entitled to impose on any other person an unlimited punishment by gross humiliation such as the Defendant has done, and claims the right to do. His conduct is a gross interference with the rights of the individuals he names.’ [133]

In reaching this conclusion, Tugendhat J rejected the possibility that the Defendant could plead a defence under s.1(3) [75]. He also rejected the Defendant’s argument that if the course of conduct complained of consists of words, and those words can be defended under the laws of libel, then they cannot constitute harassment:

‘I do not accept that that would preclude a claim in harassment. The different causes of action are directed to protecting different aspects of the right to private life. A claim in libel is directed to protecting the right to reputation. The claim in harassment is to protect persons from being subjected to unjustifiable alarm and distress. The claim under the DPA is wider than the claim under PHA, but includes the aim of protecting persons from being subjected unfairly and unlawfully to distress.’ [75]

Having found the Defendant liable for harassment, the judge granted a perpetual injunction under s. 1(2)(b) of the PHA restraining the Defendant from any further publication of the words complained of or of any similar words which amount to harassment of the Second of Third Claimants or any member of the Second Claimant firm [141].

Data Protection

The Claimants also claimed that the Defendant was in breach of his data protection obligations under the Data Protection Act 1998 (DPA). The Defendant did not dispute that he was a data controller for the purposes of the DPA.  Under s. 4(4) a ‘data controller’ is required to comply with the ‘data protection principles’ under Part I of Schedule 1. Of particular relevance to the present case were the following principles:

(i)            The First Data Protection Principle: Personal data must be processed ‘fairly and lawfully’ and, in particular, shall not be processed unless at least one of the conditions in Schedule 2 is met. For these purposes the word ‘lawfully’ applies to any form of conduct that is unlawful, including breach of confidence, libel and harassment. In the case of ‘sensitive personal data’ (which includes allegations that a person has committed a criminal offence) at least one of the conditions in Schedule 3 must also be met.

(ii)          The Fourth Data Protection Principle: Personal data shall be accurate and, where necessary, kept up to date.

(iii)         The Sixth Data Protection Principle: Personal data shall be processed in accordance with the rights of data subjects under the DPA.

In November 2010 the Law Society submitted a formal complaint about the Defendant’s compliance with the DPA to the Information Commissioner. In January 2011 the Information Commissioner wrote to the Law Society explaining that he had decided not to take any action against the Defendant. The Commissioner’s decision was based upon s. 36 DPA, which exempts ‘personal data processed by an individual only for the purposes of that individual’s personal, family or household affairs’ from the scope of the Data Protection Principles. The Commissioner’s letter explained that:

‘The inclusion of the ‘domestic purposes’ exemption in the Data protection Act (s. 36) is intended to balance the individual’s right to respect for his/her private life with the freedom of expression. These rights are equally important and I am strongly of the view that it is not the purpose of the DPA to regulate an individual’s right to freedom of expression – even where the individual uses a third party website, rather than his own facilities, to exercise this. (The s. 36 exemption clearly did not anticipate individuals using third party websites to carry out their ‘personal’ processing). The situation would clearly be impossible were the Information Commissioner to be expected to rule on what it is acceptable for one individual to say about another be that a solicitor or another individual. Although solicitorsfromhell / Mr Kordowski may well be a data controller, and is indeed registered as such, the instigators of the website content are generally private individuals expressing their own views. Their activity attracts the s. 36 exemption, which ultimately derives from Article 10 of the European Convention on Human Rights.’ [Emphasis added]

The Claimants argued that this was an incorrect statement of the law. On this point Tugendhat J explained that, while he was not conducting a judicial review of the Information Commissioner’s decision, he did not agree with the Commissioner’s analysis:

‘I do not find it possible to reconcile the views of the law expressed in the Commissioner’s letter with authoritative statements of the law. The DPA does envisage that the Information Commissioner should consider what it is acceptable for one individual to say about another, because the First Data Protection Principle requires that data should be processed lawfully… As Patten J made clear in Murray, where the DPA applies, if processing is unlawful by reason of it breaching the general law of confidentiality (and thus any other general law) there will be a contravention of the First Data Protection Principle within the meaning of s.40(1), and a breach of s.4(4) of the DPA…The fact that a claimant may have claims under common law torts, or under HRA s.6, does not preclude there being a claim under, or other means of enforcement of, the DPA.’ [100] [Emphasis added]

The judge also rejected any suggestion that the Defendant’s activities fell within the s. 32 exemption for journalism, literature and the arts:

‘Journalism that is protected by s. 32 involves communication of information or ideas to the public at large and in the public interest. Today anyone with access to the internet can engage in journalism at no cost. If what the Defendant communicated to the public at large had the necessary public interest, he could invoke the protection for journalism and Art 10. But for reasons given in many judgments in the cases against him referred to in this judgment, he cannot make any such claim, nor any claim at all for the protection under Art 10 for what he has communicated, because what he does is against the public interest. It has equally been established many times that the Defendant is responsible in law for what he communicates through the Website. The Commissioner cannot have been advised on these decisions of the courts on these matters in so many cases brought against the Defendant.’ [99]

Accordingly, on the evidence available to the court, Tugendhat J held that the Defendant was in breach of the DPA. The Defendant’s processing of the personal data of those referred to on the website was unfair and unlawful, and was contrary to the rights of the individuals concerned.  The judge therefore granted a perpetual injunction under s. 10 DPA ordering the Defendant to cease processing any personal data in respect of which the Third Claimant or any member of the Second Claimant firm was the data subject. He also made an order under s. 14 requiring the Defendant to block, erase and destroy all the data that was the subject of the claim [142].

Representative Proceedings – An overview

CPR 19.6(1) makes provision for the bringing of ‘representative proceedings’. Under this rule a party to a claim may act as a representative of any other person who has the ‘same interest’ in the claim.

The Defendant objected to the Claimants’ attempt to use the representative procedure in the present case. In essence he submitted that:

• The solicitors who had not been named on the website had no interest in the claim.
• The majority of solicitors named on the website had not opted into the claim and should therefore be assumed to have rejected pursuing a claim.The class of persons who might be represented could not be identified until liability to each of them has been established.
• In any event, any claim would not be equally beneficial to all persons in the represented class.

Representative Proceedings – Harassment and Data Protection

In relation to the harassment and data protection claims, Tugendhat J held that the Second and Third Claimants (who were, respectively, a firm of solicitors and an individual solicitor listed on the website) could act in a representative capacity on behalf of all those currently featuring on the website and those who might, in the future, feature on the website:

‘The common interest arises from the fact that the claim as pleaded is made in respect of a course of conduct, which includes data processing, which is the same or similar in relation to all the Represented Parties…There is at least a threat to cause distress to all Represented Parties in circumstances where no defence has ever been raised by the Defendant, nor could be raised by him. The question whether that course of conduct constitutes a breach of the PHA or the DPA is common to all Represented Parties because the same course of conduct is used in respect of all of them.’ [163] [Emphasis added]

However the position of the First Claimant was different. The judge held that the Law Society and the parties that it wished to represent lacked the requisite affinity of interest for the purposes of CPR 19.6: “since it does not sue for any of the causes of action for its own benefit (whether existing or threatened) it does not have the common interest and grievance” [165]. The Law Society was therefore incapable of acting in a representative capacity in this case.

Representative Proceedings – Libel

In relation to the Claimants’ attempt to bring representative claims in libel, Tugendhat J explained that the represented parties only shared a limited common interest:

‘To the extent that they complain of words which refer to all solicitors named in the Website (that is both words already published and words which the Defendant threatens to publish in the future) I accept that there is a common interest. However, whether publication of those words is, or will be, unlawful does not depend on the conduct of the Defendant. It depends upon whether the words are true or false, or whether they can be defended under one of the other established defences in libel.’ [166]

In response the Claimants argued that, in the circumstances of this case, the court should proceed on the basis that the Defendant would have no defence to any claim in libel in respect of future defamatory postings on the website. It would therefore be appropriate for the court to grant a quia timet injunction for the benefit of all the represented parties. Tugendhat J rejected this argument. He explained that, while it seems theoretical to talk of the Defendant raising any defence in libel, the Court of Appeal’s judgment in Emerald Supplies v British Airways [2011] 2 WLR 203 means that,

 “judgment in an action for libel would have to be obtained before it could be said of any person that they would qualify as someone entitled to an injunction against the Defendant, or to any remedy other than damages. The presumption of falsity may entitle a defendant to a judgment in default for damages to be assessed, but no more.” [168].

For these reasons, none of the Claimants could act in a representative capacity in relation to the claims in libel.

Relief for the Represented Parties

Having found that the Second and Third Claimants bring representative claims for harassment and breach of the DPA, the judge then considered the appropriate remedy for the represented parties. Tugendhat J began by examining the scourge of misinformation:

‘The effect of misinformation on those searching for true information is that they are likely to be misled by finding information that is in fact false. The common law, underpinned by the HRA, guarantees many freedoms, including free markets in goods and services for the benefit of the public both as consumers and as suppliers. These freedoms can only be enjoyed if there is extensive interference with freedom of expression in the form of regulations governing what can be said by suppliers.’ [179]

This point was particularly important in the context of legal services:

‘Discouraging people in need of legal advice from instructing good lawyers is as much against the public interest as encouraging them to instruct bad lawyers. At worst it may lead to miscarriages of justice (if clients do not take or follow advice because they do not trust their solicitors to give advice in their best interests). At the least it will lead to restrictions on the consumers’ freedom of choice, and to distortion of the free market in legal services.’ [181]

On the facts of the case Tugendhat J held that both the private rights of the interested parties and the interests of the public at large were strongly supportive of an injunction [175]. He therefore made an order prohibiting any further publication of the website [184].

Comment

Several aspects of Tugendhat J’s judgment call for comment.

On a general level, the decision highlights the potential overlap between libel, harassment and data protection in the online arena. As has been noted in a previous blog post, bringing a claim under the PHA may have several advantages to bringing a claim in defamation. First, the limitation period for PHA actions is the standard six-year limitation period and not the one-year period that applies in defamation actions. Secondly, a claimant may wish to obtain an injunction to restrain a defendant from pursuing any conduct that amounts to harassment. If the conduct in question is the publication of written words, then the PHA may enable the claimant to circumvent the rule in Bonnard v Perryman, which imposes very tight restrictions on the granting of injunctions in defamation claims. Thirdly, there is no reason in theory why damages should not be awarded in respect of a harassing publication of truthful allegations (although in practice it will probably be more difficult to establish that a defendant’s actions were unreasonable if the published material is substantially true).

Bringing a claim under the DPA may also offer advantages to a claim in libel or harassment. Unlike a claim under the PHA, it is not necessary to establish the existence of a ‘course of conduct’ – a single data processing incident will engage the data protection principles. Furthermore, it may be easier to establish a breach of the first data protection principle (personal data must be processed ‘fairly and lawfully’) than to succeed in a claim for defamation. As Tugendhat J explained in his judgment: ‘Inaccuracy or falsity of data may be sufficient to establish a breach of the DPA, but it is not necessary.’ [134]

On a more specific level, Tugendhat J’s disagreement with the Information Commissioner is of particular interest to media lawyers. On this issue both common sense and recent ECJ jurisprudence support the judge’s approach.

Online discussion forums are very common and many websites encourage individuals to publish critical comments anonymously. Once published, material may be very difficult to expunge no matter how unfair, unlawful or inaccurate it later proves to be. The risk of abuse is serious and self-evident. In the present author’s view, it would be a significant lacuna in the data protection regime if those websites were automatically treated as falling outside the scope of the data protection principles.

As a matter of European law, the DPA was enacted to give effect to the United Kingdom’s obligations under Directive 95/46/EC. Under the Directive, Article 3(2) and the 12^th recital provide an exception to the data processing obligations in respect of data processed in the exercise of activities that are exclusively personal or domestic. It is clear that s.36 of the DPA was intended to give effect to that obligation. In Bodil Lindqvist v Sweden C-101/10 the European Court of Justice recently held that the domestic purposes exception

“must therefore be interpreted as relating only to activities which are carried out in the course of private or family life of individuals, which is clearly not the case with the processing of personal data consisting in publication on the internet so that those data are made accessible to an indefinite number of people.” [47]

In the light of this authority, it seems clear that Tugendhat J’s analysis of s.36 is correct.

Lastly, the judgment illustrates both the possibilities and limitations of the representative action procedure under CPR 19.6. The possibilities were emphasised by Tugendhat J

 ‘…there is a need for someone to protect the public. The procedural remedy of representative proceedings, coupled with an injunction, may be the best that the law can offer at present to protect the public from the unjustifiable dissemination of false information about the suppliers of goods and services. It is also the means by which the court may protect its limited resources in time and judiciary from having to deal with large numbers of claims by different claimants against the same individual on the same or similar facts.’ [182]

However the limitations of the procedure are illustrated by the judge’s conclusion that none of the Claimants could pursue a representative claim in libel. Whenever a party seeks to invoke CPR 19.6 it is necessary to establish that the represented parties share the ‘same interest’ in the claim. The answer to this question will depend both on the nature of the cause of action pleaded and the factual context in which the claim is brought. Tugendhat J’s judgment shows that in defamation proceedings – where the cause of action depends on the exact words used and the precise circumstances of their publication – it will often be difficult to satisfy this test.

Eddie Craven, Barrister, Matrix Chambers