The Norwich Pharmacal Order (“NPO”) has, for the last five decades, been a valuable tool in the hands of a potential claimant who seeks identify anonymous wrongdoers.  A third party who holds identifying information can, if they have been “mixed up” in the wrongdoing, be ordered to disclose identifying  documents or information.

But NPOs are subject to important limits.  Recent case law has emphasised how strict those limits are.  The purpose of this post is to explore a little used but more flexible alternative available: an order for third party disclosure under CPR 31.17.

The Limits of Norwich Pharmacal Orders

Although it has earlier roots, the jurisdiction to make an NPO derives from the 1973 decision of the House of Lords ([1974] AC 133).  A third party who has become “mixed up in, so to have facilitated, the wrongdoing” may be ordered to provide documents and information to enable the applicant to identify the wrongdoer.  It is a powerful remedy but one subject to important limitations.  Although disclosure cannot be obtained from a “mere witness”, an order is only potentially available against a person “mixed up in the wrongdoing”.

This is, however, a much stricter requirement than has generally been appreciated.  In the case of Davidoff v Google LLC ([2023] EWHC 1958 (KB)) Nicklin J pointed out that there is clear authority that the person against whom the order is sought must have been “involved in the furtherance of the transaction identified as the relevant wrongdoing “([105]).  That case  involved potential defamation claims against an anonymous reviewer who had set up a Trustpilot account using a Gmail address.  However,

“whilst it might be argued that [Google] by providing a Gmail address, has “facilitated” the relevant individuals signing up for a Trustpilot account, that is not the wrongdoing upon which the Norwich Pharmacal application is based. The alleged wrongdoing is the subsequent use of the Trustpilot account to post the Review. In that second phase,  [Google] in its provision of a Gmail account, has played no role; it has neither engaged in nor facilitated the alleged wrongdoing; nor has it furthered the posting of the Review” [107].

As a result, the Court had no jurisdiction to make an NPO.

This analysis has serious consequences for what is perhaps the most common type of NPO application – against email and other internet service providers seeking the identity of those alleged to have engaged in anonymous online wrongdoing.   It is now clear that there is no jurisdiction to make an NPO in such cases (see my Inforrm case comment on Davidoff).

More generally, there are many cases in which third parties have information about wrongdoers but have not “facilitated” the wrongdoing  in question.  Nicklin J gives the example of the owner of a garage which sells a car to someone who drives it negligently causing injury but has not been identified.  The victim cannot obtain an NPO against the garage owner to enable the driver to be identified.  The garage owner is a “mere witness” ([107]) who has not “facilitated” the injury.

Third Party Disclosure Orders

There is, however, potentially a more flexible alternative remedy available . Section 34(2) of the Senior Courts Act 1981 provides that

“On the application, in accordance with rules of court, of a party to any proceedings, the High Court shall, in such circumstances as may be specified in the rules, have power to order a person who is not a party to the proceedings and who appears to the court to be likely to have in his possession, custody or power any documents which are relevant to an issue arising out of the said claim—

(a)   to disclose whether those documents are in his possession, custody or power”

This was originally confined to personal injury proceedings but, by amendment in 1999, was made a general power to order disclosure from a third party. The relevant rules of court are now contained in CPR 31.17 which provides that the court may make an order for disclosure of documents or classes of documents by a third party to proceedings where the requirements of CPR 31.17(3) are satisfied namely

“(a) the documents of which disclosure is sought are likely to support the case of the applicant or adversely affect the case of one of the other parties to the proceedings” (the “Relevance Requirement”); and

“(b) “disclosure is necessary in order to dispose fairly of the claim or to save costs” (“the Necessity Requirement”).

The principles governing the exercise of this power were recently summarised as follows (see Stokoe Partnership v Grayson [2023] 3273 (KB) [38]):

i) orders under CPR r 31.17 are the “exception rather than the rule”, as disclosure will not be routinely ordered but rather only where the relevant test is met: Frankson v Home Office [2003] EWCA Civ 655, [2003] 1 WLR 1952 (CA) at [10];

ii) the applicant does not have to show that a document sought satisfies the Relevance Requirement on the balance of probabilities but rather simply that it “may well” satisfy that requirement: Three Rivers District Council v The Governor and Company of the Bank of England (No 4) [2002] EWCA Civ 1182, [2003] 1 WLR 210 (CA) at [29], [32], and [33];

iii) where an applicant seeks a class of documents, every document falling within the class must satisfy the test under CPR 31.17(3), however a document may satisfy that test if it provides context for other more obviously relevant documents even if, in isolation, it might not satisfy the test: American Home Products Corporation v Novartis Pharmaceuticals UK Ltd (No 2) [2001] FSR 41 (CA) at [34]; Three Rivers (No 4) at [37]-[38];

iv) the Necessity Requirement is “largely, but not wholly, to follow relevance”, with the court required to consider whether the applicant has or can obtain “similar documentation or information from other sources”: Andrew v News Group Newspapers Ltd [2011] EWHC 734 (Ch) at [73];

v) in relation to the Necessity Requirement, it is important to bear in mind that:

a) necessity is a flexible concept, the precise scope of which falls to be determined in light of the facts of the particular case: Sarayiah v Royal and Sun Alliance [2018] EWHC 3437 (Ch) at [36]; and

b) the burden is on the applicant to establish the relevant necessity such that the court will not make an order if there is insufficient evidence from which it can evaluate the necessity of disclosure for the fair disposal of the claim: The Commissioner of Police of the Metropolis v Times Newspapers Limited [2011] EWHC 1566 (QB) at [29]-[30];

vi) the order should make clear what documents the respondent has to disclose without reference to the issues in the case, which the third party should not have to understand in order to comply with the order: Constantin Medien AG v Ecclestone [2013] EWHC 2674 (Ch) at [67]); and

vii) even if the test under CPR r 31.17(3) is satisfied, the court retains a discretion whether to make an order, in exercising which the court will consider any relevant competing public interests and, if necessary, strike an appropriate balance: Frankson at [13].

Third Party Disclosure – the Kerner case 

The CPR 31.17  power has been used  to obtain information about wrongdoers which would not have been available on an NP application. The leading case is the decision of Warby J (as he then was) in Kerner v WX & Anor [2015] EWHC 1247 (QB).

The claimant had obtained an injunction to restrain two individuals, whose identities were unknown, from harassing her and her 9 year old son.  The proceedings were against  “(1) WX (2) YZ (Persons Unknown responsible for pursuing and/or taking photographs of the Claimant and her son at their home on 22 January 2015)”  ([2015] EWHC 128 (QB))

The defendants had watched the claimant’s home and had taken photographs.   The claimant had taken the registration number of their car number.   In order to identify the defendants the claimant sought details of the identify of the keeper of the vehicle from the DVLA which refused to provide them. An NPO could not be made because the DVLA was not involved in the wrongdoing in any way.

Warby J noted that although the wording of CPR 31.17(3)(a) and s.34(2 of the Senior Courts Act 1981

“is perhaps not plainly and obviously apt to confer a power to order disclosure for the purposes of identifying an unknown party. .. it would be inappropriate to construe either provision in a narrow and literal way, as confined (for example) to issues arising from statements of case between identified parties, and not as extending to the question of the identity of an unknown party. To take that approach would tend to obstruct or hinder the fair disposal of litigation” [25].

He noted that rights, including the Article 8 rights, of those whose identities might be disclosed require consideration and the Court must conduct a careful balancing exercise [25]

He went to hold hold that the identity of the unknown driver was an “issue arising out of the claim” and the documents held by DVLA identifying the registered keep were “relevant to that claim” and were likely to “support of the case” of the claimant [26] to [27].  As a result he made an order for the disclosure to the claimant’s solicitors by DVLA of documents providing the identity and contact details of the registered keeper of the car in question.

Similar orders for the disclosure of information relating to “persons unknown” were made against the Metropolitan Police in two cases in which injunctions were being sought against arrested protestors (see Transport for London v Alyson Lee & 62 Ors [2022] EWHC 3102 (KB) and Shell UK Ltd v Persons Unknown [2023] 1 W.L.R. 4358 [210] to [219]).

Using Third Party Disclosure to identify wrongdoers

It is clear that from these cases that  CPR 31.17 can be used to identify wrongdoers where an NPO is not available.   There is no reason in principle why it cannot be used in “publication cases” where a third party holds documents which would enable a claimant to identify a wrongdoer.  It should, however, be noted that the power is limited to the disclosure of documents and, unlike at NPO, does not include the provision of information.

Take a typical case where an anonymous individual has published defamatory or harassing material on the internet on a blog set up using a Gmail address.  It is clear from the Davidoff case that a Norwich Pharmacal order will not be available.  The wrong is not the setting up of the blog but its use.  However, Google does have information which is likely to assist in identifying the wrongdoer.  In these circumstances, provided the claimant first issues proceedings against “persons unknown” then, following the reasoning in Kerner there would be a strong argument in favour of making an order under CPR 31.17:

  • There is an “issue” as to the identity of the defendant and documents held by Google concerning the Gmail account would be “likely to support” the claimant’s case;
  • Disclosure of documents relating to the identity of the defendant is “necessary”.
  • Balancing the Article 6 and 8 rights of the claimant against the Article 8 rights of the defendant, there is a good argument that the balance favours the making of the order.

Conclusion

An application for an CPR 31.17 is a valuable tool for a claimant who seeks information to identify a wrongdoer.   If proceedings against “persons unknown” are properly pleadable then a third party disclosure application can be made against persons who have documents which “may well” identify the defendant.

It should be borne in mind that, when making an application, a claimant is under similar obligations as arise in an application for an NPO (see the discussion the Davidoff case comment).   If the claim has not yet been pleaded then evidence must be provided to show that it has a real prospect of success.   Evidence must be provided showing why it is contended that the documents are held by the third party, why they “may well” identify the “target” (ie the “person unknown”).  The applicant must give full and frank disclosure of all matters that could be raised by the target and the balancing of Convention rights must be expressly addressed.  If all this is done, there seems no reason why, in appropriate cases, third party disclosure cannot be obtained to identify anonymous online wrongdoers.

Hugh Tomlinson KC is a member of the Matrix Chambers media and information group and an editor of Inforrm.

End Note:  An interesting discussion of the Norwich Pharmacal case itself – including the illness of Lord Kilbrandon, the evenly split House and the re-argument – can be found in Sir Robin Jacob’s Foreword to Bushell and Milner-Moore, Disclosure of Information: Norwich Pharmacal and Related Principles, 2nd Edn, 2022.