Norwich Pharmacal orders (‘NPOs’) are sought in order to discover the identity of a wrongdoer from a third party who may be in a position to identify the unknown wrongdoer, having somehow been ‘mixed up’ in the wrongdoing.
Gráinne Murphy of LK Shields analyses the granting of NPOs in Ireland, which includes a look at the recent court-ordered graduated response system.
This type of application is unusual in that the plaintiff may issue proceedings where the only relief sought is discovery of the identity of the wrongdoer, and there may be no cause of action against the defendant being asked to disclose this information.
The management of Petroceltic, a publicly listed oil and gas exploration company, was recently the target of serious allegations of wrongdoing on an internet blog hosted byWordPress. The posts, which Petroceltic had claimed were untrue and defamatory, were posted anonymously.
Headquartered in Dublin, Petroceltic issued proceedings in the Irish High Court(1) against Automattic, the California-based company that ownsWordPress, seeking the identity of the blogger so that it could issue defamation proceedings against that person. Petroceltic also sought removal of the blog posts. J Baker, stating that the posts were prima facie defamatory, granted an NPO to Petroceltic. Automattic was ordered to notify the blogger by email of the making of the High Court order. The NPO afforded the blogger seven days in which to furnish details of his or her identity and other relevant contact information. If the blogger failed to disclose this within seven days, Automattic would be required to provide the information to Petroceltic within a further period of ten days. Petroceltic also secured an order requiring that the allegedly defamatory blog be removed in its entirety, including deletion of its URL, and that any data relating to the blogger and the blog be preserved for six months. The court has not, as of yet, issued a written judgment in these proceedings.
The Petroceltic case is not the first time the Irish High Court has granted an NPO in relation to online defamation. In McKeogh v. John Doe 1 & Ors(2), the court ordered certain social networking and video hosting websites to disclose the identities of users who had defamed the plaintiff through their websites, claiming that he appeared in a YouTube video featuring an individual evading a taxi fare and posting disparaging comments about him. The plaintiff, who had proven he was out of the country when the taxi incident occurred, had been misidentified in the video, and was granted an NPO to identify the online commenters.
The jurisdiction to grant NPOs was recognised by the Irish Supreme Court in Megaleasing U.K. Ltd v. Barrett(3), where the Supreme Court cautioned that NPOs “must be sparingly used” as they are “plainly open to abuse which the courts must be alert to prevent.”Only the High Court has jurisdiction to grant an NPO in Ireland. Commentators have lamented this(4), suggesting that the rules of the circuit and district courts should be amended to extend jurisdiction to grant NPOs to the lower courts and that the Irish Rules of the Superior Courts should be amended to codify the procedure for obtaining an NPO(5).
In Ireland, the court has discretion to grant an NPO in the following circumstances: the plaintiff applying has established ‘very clear proof’ of wrongdoing; the defendant is ‘mixed up’ in the wrongdoing, though may not itself be liable; the plaintiff seeks the identity of the wrongdoers; the defendant is in a position to provide the information sought; and the plaintiff has no other means of ascertaining the information sought.
Disclosure of a person’s identity and contact information may raise issues around confidentiality and privacy. The Supreme Court in Megaleasing acknowledged this, stating that the Norwich Pharmacal procedure “requires a balancing of the requirements of justice and the requirements of privacy.”
In EMI Records & Ors. v. Eircom Ltd & Anor.(6), J Kelly acknowledged that, in considering an application for an NPO in the context of online copyright infringement, the court must balance the IP rights of the plaintiffs with the obligations of the defendant service providers toward their subscribers in respect of their confidentiality and privacy rights. J Kelly stated, “the right to privacy or confidentiality of identity must give way where there is prima facieevidence of wrongdoing.” The NPO granted in that case included privacy safeguards,” as disclosure was made conditional upon the plaintiffs providing an undertaking that the information disclosed would be used “solely for the purpose of seeking redress in respect of the infringement of copyright [...].”
In Doyle v. Commissioner of An Garda Siochána(7), the plaintiff issued proceedings against the Irish police seeking an NPO to discover documentation relating to police investigations into the 1974 bombings in Dublin and Monaghan for use in support of his complaint to the European Commission on Human Rights (‘ECHR’). The plaintiff’s application to the ECHR complained that the UK was in violation of human rights for failing to investigate the bombings adequately. The High Court refused to grant an NPO, in part because the plaintiff had failed to present evidence of wrongdoing on the part of the UK.
Only information concerning the identity of the wrongdoer may be sought, not factual information concerning the alleged wrong. In Doyle, the identity of the alleged wrongdoer, the UK, was already known, and therefore the information sought went beyond identification of the wrongdoer. The court held that an NPO was therefore inappropriate.
A defendant in proceedings seeking an NPO is generally entitled to the costs of the proceedings. The rationale for this is that it is reasonable for the defendant to ask the court to decide whether it is appropriate to disclose information which may be private or confidential.
In EMI Records (Ireland) Limited & Ors. v. UPC Communications Ireland Limited(8), J Charleton commented that evidence shows that the process of obtaining an NPO is “burdensome, and, ultimately, futile as a potential solution to the problem of internet piracy” and noted the “time, trouble and expense involved in pursuit of this remedy.” J Charleton suggested that NPOs could “become simple and inexpensive if appropriate legislative intervention occurred, placing such an obligation [the obligation to address the problem of internet piracy] by law on the internet service providers by inexpensive application to the District Court.”
In Sony Music Entertainment (lreland) Limited & Ors. v. UPC Communications Ireland Limited (Nos. 1 and 2)(9), the court considered NPOs in the context of a court-ordered graduated response system (‘GRS’) requiring UPC, an ISP, to deal with its subscribers who were found to be infringing the copyright of the plaintiffs through its service. The GRS ordered by the court provided that the ISP ought to send cease and desist letters to a subscriberupon the first two instances of copyright infringement discovered. Upon a third instance of infringement, the ISP was obliged to provide the IP address of the infringer and the date and time stamps of each instance of infringement so that the plaintiffs could make an application to the High Court seeking an NPO requiring the ISP to disclose the identity of the subscriber. Having considered that the “legal costs in bringing such applications were enormous and utterly disproportionate to the financial returns from such applications,” the court sought to make the process easier in this case by providing that the NPO applications made pursuant to the GRS would not be opposed by the defendant ISP and that no costs of the NPO proceedings would be sought by or against the defendant. This modification of the NPO process applies only to that particular court-ordered GRS.
Given the prevalence of online wrongdoing it seems likely that NPOs will continue to be a powerful tool for claimants in identifying anonymous wrongdoers. It is important to consider, however, that NPO applications will not always be successful or achieve the desired result. The court has discretion whether to grant an NPO, and, even if granted, an NPO will not always result in the identities sought being revealed, since the defendant may not ultimately have the information that is sought.
This article first appeared in E-Commerce Law & Policy Journal
1. Petroceltic International Plc & Ors. v. Aut O’Mattic A8C Ireland Ltd., High Court [Ireland] Record No. 2015/6714P, Order of J Baker dated 20 August 2015, amended 8 September 2015.
2.  IEHC 95.
3.  I.L.R.M. 497.
4. See, e.g, Abrahamson, Dwyer, Fitzpatrick, Discovery and Disclosure, (2nd ed. Round Hall 2015).
6.  IEHC 233.
7.  1 IR 249.
8.  IEHC 377 (unreported).
9.  IEHC 317, No. 2  IEHC 386.