Grant Thornton [A Firm] and Anor v Scanlan (Approved)

Factual and Procedural Background

The Plaintiff commenced proceedings against the Defendant seeking permanent injunctions concerning a CD of documents that the Plaintiff had inadvertently provided to the Defendant in response to a 2013 data access request. By deed dated 26 August 2013 an Attorney Tennant was appointed as receiver over certain assets of the Defendant. The Defendant made a data access request in 2013; the Plaintiff substantially delayed responding and, following involvement of Agency A, provided a CD on 11 September 2015. That CD contained the Defendant's personal data but also a large volume of information unrelated to the Defendant (including personal data of third parties and information of the Plaintiff).

On 3 October 2015 the Defendant alerted the Plaintiff to the unintended disclosure; on 13 October 2015 the Plaintiff acknowledged a data breach and requested the return of the material. The Defendant did not immediately return all material. The Plaintiff sought and obtained interlocutory injunctions from Judge Gilligan in late 2015; at the interlocutory hearing the Defendant gave undertakings and handed over the CD and one USB key but not one or more other USB keys which remained missing. The Plaintiff issued a Statement of Claim in February 2016; over time claims under the Data Protection Acts and claims for damages were withdrawn and the operative pleadings ultimately sought relief for breach of confidence. The Defendant counterclaimed under section 7 of the Data Protection Act (1988) for alleged loss caused by delay in providing her personal data. This judgment concerns the substantive trial of those claims.

Legal Issues Presented

1. Whether the information on the CD (other than the Defendant's own personal data) had the necessary quality of confidence and whether the Plaintiff was entitled to equitable relief for breach of confidence.
2. Whether the circumstances of disclosure (an inadvertent release) imposed a duty of confidence on the Defendant as recipient.
3. Whether the Defendant breached that duty by examining, copying, retaining, refusing to return, disclosing, or otherwise misusing the Confidential Information.
4. Whether the Plaintiff has locus standi to seek and obtain relief in respect of third parties' information contained on the CD.
5. Whether the Defendant is entitled to damages under section 7 of the Data Protection Acts for the Plaintiff's delay in responding to the data access request, and if so whether loss or damage was proved.

Arguments of the Parties

Plaintiff's Arguments

• The CD contained Confidential Information (third-party personal data and proprietary Plaintiff material) which the Defendant knew or ought to have known was not hers.
• The Defendant therefore owed a duty of confidence, but nevertheless copied the CD to USB keys, disclosed material to third parties (Third Party A and Third Party B), failed/refused to return all material and did not locate missing USB key(s), thereby breaching confidence.
• The Plaintiff sought permanent injunctions (restraining dissemination/use), delivery up of documents and destruction/deletion of copies; the Plaintiff maintained locus to seek relief in respect of third-party information it held subject to a duty of confidence.

Defendant's Arguments

• The Defendant accepted receipt of the CD and that the release beyond her personal data was unintended but contested she was under any duty in respect of information she could not have known was confidential before examination.
• The Defendant drew a distinction between third-party personal data and the Plaintiff's proprietary information and argued the Plaintiff had no entitlement to enforce confidentiality over third parties' data.
• The Defendant argued much of the material lacked the quality of confidence (some documents publicly accessible, part of legal packs, or previously leaked online) and that there was no urgent need ("no fire") for interlocutory relief; she also denied refusing to return the information and disputed some alleged disclosures.
• On the counterclaim, the Defendant relied on the Plaintiff's admitted delay in compliance with the data access request and sought damages under section 7 of the Data Protection Acts.

Table of Precedents Cited

Court's Reasoning and Analysis

The Court first set out established principles of breach of confidence (Coco test and later authorities). It then examined the CD's contents by category and concluded that, taken as a whole and subject to limited exceptions, the material was private and confidential (financial and business material; mixed documents containing both Plaintiff and third-party data). The Court rejected the Defendant's broad submission that the material lacked the necessary quality of confidence because some documents were publicly obtainable or had previously leaked: birth certificates and documents already published in legal sale packs or demonstrably online lost confidentiality, but the bulk of the CD retained confidentiality.

The Court found that a duty of confidence arose on receipt of the CD because the disclosure was inadvertent and the reasonable recipient would have realised the confidential nature. The Defendant became aware shortly after opening the CD that it contained information beyond her personal data and therefore knew or ought to have known of the confidential character.

Applying the principles in Imerman and related authorities, the Court held that the Defendant's conduct after realising the nature of the disclosure gave rise to breaches: she continued to examine the material; copied it onto USB keys; disclosed material to Third Party A and to Third Party B (and possibly to another third party though that was not established); she failed to return all copies promptly; and she represented that hard copies existed (photograph of lever-arch folders), such that a hard-copy reproduction was likely. The Court rejected the Defendant's justification that she was entitled to interrogate the data or to retain it to contact affected persons; her proper recourse, if she suspected criminality, was to report to appropriate authorities.

On locus standi, the Court rejected the Defendant's contention that the Plaintiff could not seek relief in respect of third-party information. Because the Plaintiff held the third-party data subject to a duty of confidence, it had standing to seek equitable relief to protect that information; denying such relief would frustrate the holder's duty and could render protection ineffective in urgent situations.

Finally, on the Counterclaim under section 7 of the Data Protection Acts, the Court applied Irish authority holding that section 7 requires proof of actual loss or damage; the Defendant led no adequate evidence of such loss. Consequently the Counterclaim failed.

Holding and Implications

HOLDING: The Court granted the Plaintiff permanent injunctive relief and ancillary orders and dismissed the Defendant's Counterclaim.

Direct orders granted (summarised from the judgment):

• A permanent injunction restraining the Defendant (and persons with notice) from disseminating, communicating or using the Confidential Information, subject to carve-outs for (i) birth certificates, (ii) information included in legal packs for sale of lands up to the date of the Order, and (iii) specific materials already shown to have been published on a named online account and an identified emailed attachment in November 2015.
• An order for delivery up of all documents and records containing the Confidential Information belonging to the Plaintiff.
• An order requiring the Defendant to destroy, erase and/or delete the Confidential Information in her possession under conditions to be specified by the Court.
• The Defendant's Counterclaim for damages under section 7 of the Data Protection Acts was dismissed for want of proof of loss or damage.

Implications: The decision enforces established equitable principles of confidentiality in the context of an inadvertent mass disclosure, confirms that a recipient who knows or ought to know of the confidential nature of materials acquired by mistake owes duties to refrain from examining, copying, disclosing or retaining the materials, and recognises a holder's standing to seek relief in respect of third-party data it holds subject to a duty of confidence. The Court did not purport to create novel legal principles beyond those cited and applied.