In Manish Patel v Unite, [2012] EWHC 92 (QB), a pilot, who claims he was defamed and harassed by postings on the British Airline Steward and Stewardesses Association (BASSA) forum, applies to the court for an order to allow an independent expert to copy and examine the forum database in order to identify who posted the defamatory statements. This action is to follow up on a previous order for BASSA to search their own forum database, which they claim was not technically possible as the records had been deleted. The case raises interesting issues on privacy, anonymity, intrusive judicial orders, union rights, the importance of technical expertise and the relevance of waivers in a website’s terms and conditions.
Background
The harassment apparently began when Mr. Patel, a pilot for British Airlines and a member of the British Airline Pilots Association was identified as having trained as a volunteer cabin crew member when BASSA, a subset of the Unite union, was threatening an action. Afterwards, Mr. Patel and other pilots who trained as volunteer cabin crew were threatened and harassed online and elsewhere. Mr. Patel blames this abuse on the widespread publicity that resulted from his being identified in the abusive and defamatory postings on the BASSA forum. He claims these postings were libelous and raises a second cause of action under the Protection From Harassment Act 1997. The postings alleged that Mr. Patel was unsafe to fly with, had lied, was unfit to be a captain, behaved erratically and illegally, fired innocent cabin crew and was involved in police corruption. All the postings were made under anonymous usernames and, without disclosure of the identities of the writers, Mr. Patel cannot bring his proceedings against those responsible.
BASSA’s forum is operated by Unite, the larges union in the UK. The terms and conditions of the website “reserve the right to disclose the true identities of users to third parties, if requested, subject to the user’s data protection rights.” In June or July 2011 Unite took the forum offline and published a statement that the allegations made about Mr. Patel were untrue, but did not identify the users who made the postings, as requested by Mr. Patel.
On 30 September 2011, Mr. Patel was granted a Norwich Pharmacal order which obliged Unite to carry out a reasonable search to locate and identity the home address and IP address of the persons associated with the usernames collected by Mr. Patel.
According to the site’s administrators it was not possible to comply with the order because since the site had been taken down, all that remained was a dated backup. The backup would only reveal the identity of the members using a particular username at that particular date. Apparently it was common practice for members to change usernames in order to hide their identities from British Airlines, as well as reuse names. Therefore associating a user with a username at the date the backup was taken would not guarantee it was the same user who had made the posts at issue at the time the posts were made. Furthermore, the administrator claimed the retrieving of the IP address of the users in question was not possible.
Application
Mr. Patel, unsatisfied with this response, made a second application that “in the event of Unite not being able to provide some or all of the information sought, an independent expert should be given access to all available copies of the BASSA forum database and permitted to make an image of the database and/or such other electronic copy of data on the database (existing or deleted) as the expert might consider necessary in order to prepare a report limited to the identification of the information sought” (para 13). According to Mr. Patel, the initial search made by BASSA was unreasonable because they failed to supply the information requested or explain what happened to it. Mr. Patel had technical experts who stated that since the forum was run on widely understood software (phpBB version 3 and MySQL), identification of the IP addresses from where the posts were made would be possible.
Mr. Patel then sent BASSA instructions on how to retrieve the requested information. The site administrator, a BASSA branch secretary with a non-technical background, said this was not possible as the posts had been deleted and the first step in the instruction required the relevant post. Justice Parks notes that it might be though curious that BASSA took the forum off line and did not make a back-up (para 11). Mr. Patel and his experts noted that previous searches had yielded portions of the allegedly defamatory posts.
Instead of taking the position that BASSA is being wilfully unhelpful or untruthful, he claims that they lack the technical capability to carry out this search themselves. Hence his request to allow a third party to examine the forum database.
Reasoning
Justice Parkes acknowledges that the order sought by Mr. Patel is intrusive (para 28) and that there were no authorities on point. He relies on a paragraph from Matthews & Malek on Disclosure (Sweet & Maxwell, 2007) which states that only if necessary and proportionate can the court order access to be given to a party’s computer or database. Parkes J does find necessary and proportionate to make the order. Especially because the requested order is necessitated by the lack of compliance with the previous judicial order. Furthermore, when faced with evidence from Mr. Patel’s experts, BASSA’s representatives were not able to conclusively show what information had been deleted and what remained on the database.
Unite claimed that the personal data of union members contained on the database was protected under Article 8 of the European Convention and that information about trade union membership fell within the definition of sensitive personal data under the Data Protection Act 1998. Parkes J writes that “the information involved is not of the most sensitive kind: we are not talking here about information relating to religious beliefs, or sexual life, or medical matters” (para 30). He finds that the order is proportional and necessary, even though contrary to the Data Protection Act, because there is no other way which the harm done to Mr. Patel could be exposed. He states “In this case, as in many other Norwich Pharmical cases, necessity and proportionality might go hand in hand.”
Finally, Parke J references the terms and conditions agreed to by those who posted on the BASSA forum that the right to disclose their identities was reserved. And that damage done to innocent parties who posted on the forum, can be mitigated by having an independent third party carry out the analysis.
Comments
Issues of user privacy are a topic of vocal public debate in a Canada at present, especially surrounding Bill C-30. Manish v Patel, and the Norwich Pharmacal line of cases demonstrate a common law approach to orders requiring disclosure of user information when linked to a cause of action and shown to be necessary and proportional. In Canada the debate mostly centres around the roles of ISPs in providing user data, though many point out that often ISPs are quite forthcoming and accommodating of law enforcement.
Beyond illustrating the irony that there is no apparent solidarity between pilots and flight attendants and their respective unions, one of the differentiating elements of this case was the lack of compliance on the part of BASSA, with the initial, less intrusive disclosure order. Manish v Patel shows how the court may respond to lack of compliance or lack of technical capability with a more intrusive order, while balancing innocent user’s privacy rights.
The future for this line of reasoning will be interesting, especially as different causes of action are tried. Here the cause of action is harassment and defamation, whether an order will be made for third party experts to independently review a website’s data with regard to a copyright infringement claim remains to be seen.
Kalen Lumsden is a JD candidate at Osgoode Hall Law School.