The legal protection of online identities

Millions of people post comments on the web in response to articles, blogs and stories. Many do so anonymously.

What should someone do if they want to take action against the person responsible for an anonymous posting?  In most cases, website owners will not be able to release details about them because of data protection laws and their contractual relationship with their users.

The alternative is for an application to be made for a Court order requiring the disclosure of the person's true name and contact details.  These orders are known as "Norwich Pharmacal Orders" (NPOs).  In Mitsui Ltd v Nexen Petroleum UK Limited, Lightman J set out three conditions which must be met for the court to exercise its NPO jurisdiction:

“21.  The three conditions to be satisfied for the court to exercise the power to order Norwich Pharmacal relief are:

(i) a wrong must have been carried out, or arguably carried out, by an ultimate wrongdoer;

(ii) there must be the need for an order to enable action to be brought against the ultimate wrongdoer; and

(iii) the person against whom the order is sought must: (a) be mixed up in so as to have facilitated the wrongdoing, and (b) to be able or likely to be able to provide the information necessary to enable the ultimate wrongdoer to be sued."

Privacy rights

NPOs usually involve an interference with web-users' Article 8 rights because they will lead to the disclosure of their identify and contact details without their consent.

This issue was first considered by the Court of Appeal in Totalise v Motley Fool. Aldous LJ was particularly concerned about the Article 8 and 10 issues raised by disclosure, and suggested a procedure for notifying defendants:

1. "the court must be careful not to make an order which unjustifiably invades the right of an individual to respect for his private life, especially when that individual is in the nature of things not before the court: see the Human Rights Act 1998, s.6, and the European Convention on Human Rights, Arts. 10 and (arguably at least) 6(1)……

1. It is difficult to see how the court can carry out this task if what it is refereeing is a contest between two parties, neither of whom is the person most concerned, the data subject; one of whom is the data subject's prospective antagonist; and the other of whom knows the data subject's identity, has undertaken to keep it confidential so far as the law permits, and would like to get out of the cross-fire as rapidly and as cheaply as possible. However the website operator can, where appropriate, tell the user what is going on and to offer to pass on in writing to the claimant and the court any worthwhile reason the user wants to put forward for not having his or her identity disclosed. Further, the Court could require that to be done before making an order. Doing so will enable the court to do what is required of it with slightly more confidence that it is respecting the law laid down in more than one statute by Parliament and doing no injustice to a third party, in particular not violating his convention rights. "

Trivial complaints

A few years later, the High Court considered whether to grant a NPO in Sheffield Wednesday FC Ltd v Hargreaves, where the claimant sought disclosure of the identities of eleven users of a football fansite.

The Court found that nine of the postings bordered on the trivial and it would be disproportionate and unjustifiably intrusive to make an order for the disclosure of the identities that "which are barely defamatory or little more than abusive or understood as jokes".  The judge did, however, grant a NPO in respect of the more serious allegations complained of, holding that the claimant's entitlement to protect its reputation outweighed the right of the authors to maintain their anonymity.

Clift v Clarke

These principles have been considered again this year by the High Court in the unreported decision in Clift v Clarke.

In 2009 Clift had successfully sued Slough Borough Council who had added her name to the Violent Persons Register without good reason after she had complained about anti-social behaviour in her local park.

Now, Clift applied for a NPO to identify two anonymous users of Mail Online who had posted what she said were defamatory comments about her in relation to her case against Slough.  She described the newspaper's own coverage of her case as "excellent".

Sharp J dismissed the application.  First, she said the comments were no more than "pub talk" and it was fanciful to suggest that a sensible and reasonable reader would take them any other way, particularly in the context of the newspaper's wider coverage.  Secondly, by the time of the hearing the posts had been removed, having only been discovered by Clift more than a year after posting.  Any claim Clift might have would be weak.  Thirdly, the privacy rights of the anonymous users had to be taken into account.  Overall, Sharp J found it was disproportionate to grant the application and she declined to exercise her discretion.

Where there is evidence of a campaign against a claimant, or the allegations are serious or being disseminated widely, then the Court is likely to grant a NPO.  However, in cases such as Clift, where there have been stale internet postings that are unlikely to have damaged the claimant's reputation, NPOs are likely to be refused.

There is a good post on Clift v Clarke here.  The post is by Sarah Palin of 1 Brick Court, who appeared as Counsel for Mail Online, and contains a useful commentary on the defamation aspects of the decision.

See further section 6.4 of the Privacy Law Handbook