The Rugby Football Union v Consolidated Information Services Ltd

Factual and Procedural Background

Company A is the governing body for rugby union in England and owns “The Stadium,” which seats approximately 82,000 spectators. To promote the sport and keep prices affordable, Company A distributes match tickets through schools, clubs and other affiliated bodies under strict contractual terms prohibiting resale above face value and declaring the tickets its property at all times.

Company B (formerly known as another corporate name and now in liquidation) operated an online platform that anonymously facilitated secondary ticket sales at market prices. Company B suggested prices to sellers, processed transactions and retained a percentage of sale proceeds. Its website contained a privacy policy accessible through a link and by agreement during user registration.

Monitoring by Company A revealed thousands of tickets for seven international matches being advertised on the platform at prices far exceeding face value—some tickets costing £20-£55 were offered for about £1,300. After correspondence seeking seller identities was rebuffed, Company A issued High Court proceedings on 21 March 2011 for a Norwich Pharmacal order compelling Company B to disclose the identities of those advertising, selling or buying the tickets.

The High Court (Judge Tugendhat) granted the order, finding good arguable cases of breach of contract, conversion and trespass. The Court of Appeal dismissed Company B’s appeal. Company B then appealed to the Supreme Court (the present judgment), confining its challenge to the contention that disclosure would infringe Article 8 of the EU Charter on Fundamental Rights concerning personal data protection.

Legal Issues Presented

1. Whether granting a Norwich Pharmacal order compelling disclosure of personal data held by Company B is a proportionate interference with the Article 8 Charter right to data protection.
2. Whether proportionality must be assessed solely by reference to the utility of data relating to each individual transaction, or may include broader objectives such as deterrence and enforcement of contractual terms.
3. (Raised but ultimately unnecessary) Whether users of Company B’s website had given unambiguous consent to disclosure sufficient to satisfy Article 7(a) of Directive 95/46/EC.

Arguments of the Parties

Appellant’s Arguments (Company B)

• The order would constitute an unnecessary and disproportionate interference with the data subjects’ rights under Article 8 of the Charter.
• Proportionality must be evaluated by balancing the impact on each individual data subject against the particular benefit to Company A in relation to that individual’s transaction; wider deterrent considerations are irrelevant.
• Relied on Promusicae, Bonnier Audio and Goldeneye to support an “individualised” proportionality test.

Respondent’s Arguments (Company A)

• The order is the only realistic method of identifying wrongdoers and enforcing contractual and property rights; alternative means are unavailable.
• The interference with privacy is minimal: only names and addresses of persons who knowingly breached clear ticket-sale terms will be disclosed.
• Deterrence of future breaches and protection of the affordable-ticket policy are legitimate and weighty objectives.
• In the alternative, users had consented in the website’s privacy policy to disclosure when required by law.

Table of Precedents Cited

Court's Reasoning and Analysis

The Supreme Court undertook a proportionality assessment under Article 8 of the Charter and the Data Protection Directive. It accepted that disclosure involved processing personal data and that the Charter therefore applied. The Court rejected Company B’s submission that proportionality must be assessed solely transaction-by-transaction. Instead, it held that wider objectives—including deterrence of future breaches and vindication of contractual and property rights—are legitimate considerations.

The Court found:

• Company A had a strong arguable case of breach of contract, conversion and trespass.
• No alternative source of the information existed; Company B’s anonymity facility thwarted enforcement.
• Disclosure would reveal only names and addresses of persons who had knowingly breached clear ticket conditions; any intrusion into privacy was limited.
• The public interest in affordable access to sport and in discouraging ticket touting outweighed the modest impact on individual data subjects.
• Previous authorities emphasise flexibility and a multi-factor balancing exercise, not the narrow focus urged by the appellant.

An alternative argument that users had consented to disclosure was dismissed: any consent extended only to proportionate, lawful disclosure, which returns the analysis to the proportionality test already satisfied.

Holding and Implications

APPEAL DISMISSED. The Norwich Pharmacal order compelling Company B to disclose the identities of those selling or purchasing tickets in violation of Company A’s terms is upheld.

Implications: The judgment confirms that, even where personal-data rights under the EU Charter are engaged, courts may grant Norwich Pharmacal relief when (a) wrongdoing is arguable, (b) the information is otherwise unobtainable and (c) disclosure is a proportionate means of vindicating rights. The Court endorsed a contextual, multi-factor balancing approach, clarifying that deterrence and broader policy objectives can legitimately inform proportionality. No new legal test was created, but the decision strengthens the ability of right-holders to obtain identifying information from intermediaries who facilitate anonymous wrongdoing.