Sex offender’s attempt to hold law firm to ransom over data breach backfires

In Chief Constable of Kent Police & Anor v Taylor [2022] EWHC 737 (QB), Mr Justice Saini considered a claim for breach of confidence, arising from the Defendant’s refusal to delete videos that a law firm that had accidentally disclosed to him and which contained sensitive information about a vulnerable minor.  The videos were taken by officers in the employment of Kent Police (the First Claimant) and showed them arresting the individual (referred to as KDI).   Upon being asked by the law firm - Berrymans Lace Mawer (BLM) (the Second Claimant) - to delete the videos, the Defendant refused, and instead demanded payment in exchange for his cooperation.  The Claimants sought an injunction prohibiting the Defendant from sharing the videos and further relief ordering the deletion of the videos from the Defendant’s devices.  The Court granted this relief and in addition, ordered that the Defendant disclose the identity of any individual with whom he had shared the videos.

Facts

BLM  acted for Kent Police in relation to a civil claim brought by a minor, KDI, for breach of his rights under Articles 3, 4 and 8 of the European Convention on Human Rights.  KDI ‘s case was that he had been wrongfully arrested and searched a total of nine times.

To defend the claim, Kent Police provided BLM with three videos which showed KDI being arrested and searched on 1 August 2019 and again on 7 October 2019.  KDI was clearly identifiable in all the videos; the August video included KDI’s full name, his appearance, his age and details of him being a missing person.  The two videos taken in October included similar details.

Separately, BLM acted for Kent Police in a civil action brought by Mr Taylor, who had sued Kent Police for £390 for the damage its officers allegedly caused to his door when searching his home in execution of a search warrant.  The officers had been searching for indecent images of children.  Mr Taylor was subsequently charged with and pleaded guilty to possession indecent images of children, receiving a custodial sentence of nine months.  Mr Taylor had several previous convictions for the same offence.

On 22 December 2021, BLM sent Mr Taylor an invitation via a hyperlink to an encrypted, file-sharing tool, to allow him to view the video evidence that Kent Police intended to rely on as part of an application for summary judgment in Mr Taylor’s claim against them.  The invitation was accompanied by wording that made it clear that the user was not to forward the links and that the information contained within them was sensitive.

On 6 January 2022, an employee at BLM uploaded the videos relating to KDI’s claim to the same encrypted file-sharing platform.   For reasons that remain unclear, Mr Taylor was inadvertently granted access to these videos, as well as the ones relating to his case.

On 7 January 2022, Mr Taylor sent a message to an employee at BLM saying that he had access to the videos of KDI, and that this was “a serious privacy violation.”  BLM’s IT data showed that Mr Taylor downloaded all three videos.  BLM responded to Mr Taylor saying that the videos were confidential, and that this confidentiality was especially important in light of the fact that the videos contained information relating to a minor who is subject to an anonymity order in other proceedings.  BLM asked Mr Taylor to delete the copies of the videos that he had downloaded.  They also told him that if he did not provide confirmation that he had done so, that it might be necessary to commence proceedings against him and to obtain a Court Order requiring him to delete the videos.

Mr Taylor refused to provide any such guarantee, and instead claimed that BLM owed him £4,137.50 in the following email:-

 “Hideous proto-sentient drones of the foreign country of London, you lack soul. You are incapable of understanding that you are the root to the eternal problems of civilization, besides just being lawyers.

Agent of BLM, I Hope this costs your master's company as much money as possible.

It was your actions which created a breach of confidence.

Do not contact me again unless is to discuss the payment of money you owe me. Full legal expenses and claim accounted. £4137.50

Back to your artificial "work", and whatever tiresome bourgeois weekend routine."

In subsequent emails, the Defendant repeated his demand for payment and made further offensive statements.

Cause of Action

The Claimants sued in the law of confidence.  To establish a claim, the Claimants needed to show that the information within the videos had the necessary quality of confidence; that it was shared with Mr Taylor in circumstances that created an obligation on behalf of the Defendant and that there had been an unauthorised use or a threat to use that information.

Saini J set out the relevant principles of the modern law of confidence beginning with Attorney General v Guardian Newspapers Ltd (No 2) [1988] UKHL 6(better known as Spycatcher).  He concluded that the law is now settled that the circumstances in which information is shared is not relevant where the information is obviously confidential.  In this case, the links to the file-sharing services had been accompanied by a warning that the recipient was not to share its contents with anyone else and that the information was sensitive.   The fact that the access had been granted inadvertently did not diminish the confidential nature of the information.

Secondly, the conscious retention of copies was enough to establish the tort, meaning a claimant does not need to show actual use or a threat to use.  The fact that the Defendant had refused to delete the videos was therefore sufficient to warrant relief.

Finally, the judge determined that both Claimants had standing to bring a claim for injunctive relief, the first as the owner of the videos and the second as custodian of the same.

Relief

The judge concluded that, in addition to “standard prohibitory relief” preventing any disclosure, the Claimants were entitled to additional relief, namely an order for disclosure and independently overseen permanent deletion of the videos from the Defendant’s devices.

In Gulati v MGN Ltd [2015] EWHC 1482 (Ch) Mann J held that orders for disclosure are available in the tort of misuse of private information.  Saini J saw no reason why the same principle should not apply when “enforcing classic confidentiality rights”.  To ensure that the confidentiality had not been breached by Mr Taylor, the judge ordered that Mr Taylor should provide BLM with a sworn affidavit containing “certain information as to his dealings with the Videos”, including “the names and full contact details of all persons and entities to whom such disclosure have been made, the date of disclosure, what was disclosed, and the circumstances of disclosure.”

The judge also made an independent deletion order, requiring Mr Taylor attend BLM’s offices with his devices so that an IT expert could permanently erase the videos from the Defendant’s devices – a process Mr Taylor said he would not cooperate with in any shape or form.

Mr Taylor was ordered to pay the Claimants’ costs of the claim.

Comment

It was not difficult for the Court to find for the Claimants in this case.  The Defendant had refused to delete the videos and had repeatedly sought to extract money from the Second Claimant in correspondence.  The case is of greater significance in the relief ordered by Saini J.  Although Gulati  established that disclosure orders are available in misuse of private information claims, this case was novel in its application of that relief to a breach of confidence case.  Saini J considered such relief to be “particularly necessary” in this case because the Defendant was a “sophisticated IT user” who had resisted the Second Claimant’s “simple and reasonable requests” to delete the videos and not to disclose them to any other third party.

At the hearing of the Claimants’ application, the Defendant did not help his position by making clear that he would not comply with any orders made.  The Defendant may wish to reconsider his position.  As Saini J warned, where a party fails to comply with an injunction, the court has the power to punish them for contempt of court.  By way of example, in Oliver v Shaikh [2020] EWHC 2658 (QB), Mr Shaikh ignored an injunction and refused to engage with the Court. Committing him to prison for 16 months, Nicklin J spoke about the harm of non-compliance, explaining “…Court orders must be obeyed. If they are not, it corrodes the rule of law.“