Boulbet v Sumup Ltd (Approved)

Factual and Procedural Background

The Plaintiff, a retired gentleman and foreign national residing outside the jurisdiction, alleges that he was defrauded through investment schemes promoted by individuals falsely representing legitimate banks. Initially, he invested approximately €280,000 into purported care home facilities in Spain via transfers to various Spanish banks between March and June 2021. Subsequently, he was contacted by another individual claiming to represent a major bank in a different European city, who informed him that his initial investments were fraudulent and advised withdrawal. The Plaintiff then reinvested approximately €1,500,000 in various investment products, transferring funds to multiple accounts including Irish bank accounts held by the Defendant between December 2021 and February 2022. Upon attempting to verify the identity of one alleged representative, the Plaintiff discovered the individual did not work for the purported bank, confirming he was a victim of fraud on two occasions. The Plaintiff has made criminal complaints and retained legal counsel in several EU countries. He now seeks court orders compelling the Defendant, a financial institution operating in the jurisdiction, to disclose information and documents relating to certain bank accounts to identify unknown perpetrators and trace misappropriated assets. The Defendant neither consents nor objects to some reliefs but disputes the scope of disclosure sought for certain identity verification documentation.

Legal Issues Presented

1. Whether the court should grant a Norwich Pharmacal Order ("NPO") compelling the Defendant to disclose information identifying unknown wrongdoers involved in the alleged fraud.
2. Whether the court should grant a Banker's Trust Order requiring the Defendant to produce broader documentation, including identity verification documents used to open certain bank accounts.
3. The scope and limits of equitable jurisdiction in ordering disclosure of personal and banking information in the context of alleged cyber-fraud and asset tracing.
4. Whether the Plaintiff’s delay in seeking disclosure affects the availability of relief under the Banker's Trust jurisdiction.
5. Balancing the Plaintiff’s interest in disclosure against the Defendant’s obligations to maintain customer confidentiality and data protection compliance.

Arguments of the Parties

Appellant's Arguments

• The Plaintiff contends entitlement to disclosure of identity verification documents under either an NPO or a Banker's Trust Order, emphasizing the equitable and flexible nature of these remedies.
• He relies on Irish and UK jurisprudence, including Megaleasing, Blythe, and Richmond Homes, to support an expanded scope of disclosure beyond mere identification of wrongdoers to include documents assisting in tracing dissipated assets.
• The Plaintiff argues that photographic identification documents are critical to establishing the geographical whereabouts and true identities of perpetrators, especially given the likelihood of fabricated biographical details.
• He submits that the relief sought is necessary and proportionate in the context of complex transboundary cyber-fraud and that piecing together such information is essential for effective pursuit and recovery of assets.
• Delay in seeking disclosure is explained by ongoing criminal and civil proceedings across multiple jurisdictions and should not be fatal to the application.

Appellee's Arguments

• The Defendant agrees with the Plaintiff on some reliefs but objects to the disclosure of identity verification documentation, arguing that it duplicates other reliefs and exceeds what is necessary under the jurisprudence.
• It emphasizes its duty to maintain customer privacy and comply with data protection laws, particularly as the account holders are not parties to the proceedings.
• The Defendant relies on the judgment in Blythe to argue that disclosure should be strictly limited to information necessary to bring a claim and not extend to documents required to prove it, which is a matter for ordinary discovery procedures.
• It submits that the Plaintiff can bring proceedings once names and addresses are disclosed and that the documentation sought is not a critical "missing piece of the jigsaw."
• The Defendant asserts that the Plaintiff falls short of criteria for a Banker's Trust Order, particularly regarding delay and the likelihood that the information will preserve assets, citing recent UK cases where delay precluded relief.

Table of Precedents Cited

Court's Reasoning and Analysis

The court carefully considered the distinct equitable jurisdictions underpinning Norwich Pharmacal Orders and Banker's Trust Orders. It acknowledged the Plaintiff’s status as a victim of a sophisticated, multi-faceted cyber-fraud involving fabricated identities and cross-border transactions. The court recognized that while disclosure of names and contact details is fundamental, photographic identification documents provide a vital additional means to identify perpetrators and trace assets, given the likelihood of misleading or false biographical information.

The court applied established principles from Blythe and Kyriakou, requiring that disclosure be necessary, proportionate, and limited to what is strictly needed to bring or pursue a claim. It accepted that photographic ID does not prove the claim but facilitates bringing it by identifying the correct defendants. The court rejected the Defendant’s argument that such documents are not necessary, emphasizing the realistic manner in which frauds operate and the need for comprehensive information to trace dissipation of assets.

The court balanced the Plaintiff’s interest in disclosure against the Defendant’s obligations to protect customer confidentiality and comply with data protection laws. It concluded that the Plaintiff’s interest in obtaining justice and recovering misappropriated assets outweighs the potential detriment to the Defendant, especially given the requirement that the Plaintiff give appropriate undertakings restricting the use of disclosed information.

Although acknowledging some delay in the Plaintiff’s application, the court found this excusable due to ongoing multi-jurisdictional proceedings and correspondence. It held that the delay was not fatal to the relief sought.

In sum, the court endorsed an incremental and flexible approach to equitable reliefs in the digital age, recognizing the necessity of adapting traditional doctrines to modern cybercrime realities to ensure access to justice.

Holding and Implications

The court’s final decision is to grant the orders sought in relation to all categories of information, including the production of photographic identification documents used to open the relevant bank accounts, under both Norwich Pharmacal and Banker's Trust jurisdictions.

This ruling directly enables the Plaintiff to pursue identification and recovery actions against unknown perpetrators of the fraud. The decision reflects an extension of equitable jurisdiction recognizing the complexity of cyber-fraud and the importance of comprehensive disclosure to victims. No new binding precedent was established, but the court’s reasoning affirms the flexible development of equitable remedies in this jurisdiction consistent with existing case law. The Plaintiff must provide appropriate undertakings governing the use of the disclosed information, ensuring a balance between justice and privacy rights.