High Court of Ireland Decisions

THE HIGH COURT

[2022] IEHC 610

[RECORD NO. 2015 9954 P]

 

 

BETWEEN

 

GRANT THORNTON (A FIRM) and GRANT THORNTON CORPORATE FINANCE LIMITED

 

PLAINTIFF

 

AND

 

GERARDINE SCANLAN

 

 

DEFENDANT

 

JUDGMENT of Mr. Justice Dignam delivered on the 17^th day of October 2022.

 

Introduction.

 

1.            This matter has had a long and protracted procedural history. I am told by counsel for the plaintiff that over 50 affidavits have been filed and over eight interlocutory judgments have been delivered to date, either by the High Court or the Court of Appeal. This judgment deals with an application by the defendant to compel the plaintiff to provide further and better particulars and an application for discovery by the defendant. The application for discovery is brought in unusual terms but it was treated as a motion for discovery by the parties and I propose to deal with it as such.

 

2.            It will be necessary to set out some of the long and protracted procedural history because part of that history involves changes to the pleadings and it will be necessary, in order to assess whether the further and better particulars sought or discovery should be directed, to identify precisely what the parameters of the case are on the basis of the current pleadings.

 

3.            The genesis of the case is set out in paragraphs 3-10 of Baker J’s judgment on behalf of the Court of Appeal on the 31^st October 2019 ([2019] IECA 276) and quoted in Pilkington J’s judgment on the 2^nd June 2020 ([2020] IEHC 509).  Grant Thornton replied to a data access request by the defendant. They purported to do so by providing a CD containing documents to the defendant. It seems that CD contained personal data relating to the defendant but also a vast volume of data/information relating to third parties and data/information which was claimed to be the plaintiff’s proprietary information.

 

4.            Grant Thornton requested the defendant to return the CD and to give an undertaking that the information would not be disseminated. An undertaking in the terms sought was not forthcoming and the plaintiff issued proceedings on the 27th November 2015 and sought, and obtained, interlocutory injunctive relief on the 4th December 2015, inter alia, directing the defendant to return to the plaintiffs certain confidential information that had been sent to her in error. These orders were made on consent.

 

5.            The matter then proceeded and there were a number of iterations of the pleadings. For the reasons set out above, it is necessary to set out in some detail the procedural history of the matter.

 

6.            The Plenary Summons was issued on the 27th November 2015 and was amended on the 3rd December due to typographical errors and on the 4th December 2015 to join Grant Thornton Corporate Finance Limited as a plaintiff and to make consequential amendments.

 

7.            A number of reliefs were sought including, in summary, orders restraining the defendant from disseminating the “Confidential Information” as defined in the Schedule to the Plenary Summons, directing her to deliver up all documents and records containing the Confidential Information belonging to the plaintiffs, requiring her to destroy the Confidential Information in her possession and requiring her to take all necessary steps to retrieve from the public domain any of the Confidential Information which she had disseminated, and an order restraining her from processing any personal data, other than her own, other than in accordance with the Data Protection Acts. The plaintiffs also sought damages for “breach of confidence and/or misuse of private information”, damages for “breach of privacy” and damages for “breach of statutory duty, including but not limited to, damages pursuant to section 7 of the Data Protection Acts, 1988 and 2003.”

 

8.            The Schedule to the Plenary Summons defined “Confidential Information” as “All information provided by the Plaintiffs to the Defendant in electronic form on 11 September 2015 other than the Defendant’s own personal data, within the meaning of the Data Protection Acts, 1988 and 2003.” The reference to the “Data Protection Acts, 1988 and 2003” in this definition (though not in the body of the Plenary Summons or Statement of Claim) clearly refers to the defendant’s “own personal data.”

 

9.            Gilligan J granted a number of reliefs on consent on the 4th December 2015. There was no appeal from this Order.

 

10.         A Statement of Claim was delivered on the 23rd February 2016. It may be helpful to quote a number of the paragraphs from this Statement of Claim:

 

“7. While the CD contained personal data relating to the Defendant (within the meaning of the Data Protection Acts) as a result or inadvertence it also included other information comprising confidential information and/or personal data relating to third parties and confidential proprietary information of Grant Thornton, including material which was legally privileged. The information on the CD (other than the personal data relating to the Defendant) is hereafter referred to as the “Confidential Information.”

 

8. Upon receipt of the Confidential information, the Defendant knew, or ought to have known, that the Confidential Information was not the Defendant’s personal data, within the meaning of section 1 of the Data Protection Acts and that the release of the Confidential Information to her was unintended.

 

9. By letter dated 3 October 2015, the Defendant alerted Grant Thornton to the fact that she had found on the CD furnished to her items of information, including deeds of appointment of receivers in respect of properties unconnected with her.

 

10. In the premises, at all material times following the receipt of the Confidential Information, the Defendant knew of ought to have known that the Confidential Information was confidential information belonging to Grant Thornton which had been released to her in error. Further, the Defendant knew, or ought to have known, that she had no entitlement to receive, retain or publish the Confidential Information.

 

11. In the circumstances, following the receipt of the Confidential Information, the Defendant was under an obligation to maintain the confidentiality of the Confidential Information and was not entitled to publish, disseminate or use the Confidential Information in any way.

 

12.Further, and/or in the alternative, the Defendant was under the statutory obligation not to process the Confidential Information other than in accordance with the provisions of the Data Protection Acts.

 

13. By letter dated 13 October 2015, Grant Thornton advised the Defendant that an data had inadvertently occurred and requested her to return the Confidential Information and not to retain any copies of it.”

 

11.         It is clear from these paragraphs (and, indeed, from the reliefs sought in the Plenary Summon and the Prayer for Relief) that there were two limbs to the plaintiff’s case even at this stage: a breach of confidence claim and a claim grounded on the Data Protection Acts.

 

12.         Indeed, paragraph 14 of the Statement of Claim set out the Particulars of breach of confidence, breach of duty and breach of the provisions of the Data Protection Acts. It stated under the heading “Particulars”:

 

“On 13 October 2015, the Defendant sent certain documents comprised in the Confidential Information to a number of third parties. Separately, on 3 November 2015, Grant Thornton was contacted by a third party, Gerard Scriven, who referred to documents included in Confidential Information which he stated had been furnished to him by the Defendant. On 16 November 2015, Stephen Tennant of Grant Thornton received a voicemail from a further third party who subsequently informed him that the Defendant had contacted him regarding a specific document within Confidential Information concerning this third party.

 

Grant Thornton has also received correspondence from other third parties who have in their possession documents comprising of the Confidential Information. In addition, certain documents contained in the Confidential Information have been made available to view by the public at large on social media. The Defendant also confirmed to Grant Thornton, its servants or agents, that in addition to having disclosed the Confidential Information to Mr. Scriven, she disclosed the Confidential Information to Mr William McKeogh with offices in Athlone, County Westmeath. These disclosures were made wrongfully and without permission or knowledge of Grant Thornton.”

 

13.         It then set out a further heading “Additional Particulars of Breaches of Data Protection Acts” which gave specific particulars of the alleged breaches of the Acts, thereby making it clear that there were two elements to the plaintiff’s claim: a breach of confidence claim and a breach of the Data Protection Acts claim.

 

14.         A Defence and Counterclaim was delivered by the defendant on the 30th June 2016. The Defence ran to 167 paragraphs and the Counterclaim consisted of 17 paragraphs.

 

15.         The plaintiffs issued a motion seeking to strike out various parts of the Defence and Counterclaim and this was heard by Gilligan J. He gave a reserved judgment on the 27th July 2017. This was a lengthy judgment in which he summarised at length the nature of the plaintiffs’ claim. He ordered that the defendant deliver an amended Defence and Counterclaim. This was upheld by the Court of Appeal.

 

16.         A revised Defence and Counterclaim in purported compliance with Gilligan J’s Order was delivered on the 18th December 2017.

 

17.         The plaintiffs delivered a Reply and Defence to Counterclaim to this revised Defence and Counterclaim on the 18th April 2018. By way of preliminary objection, the Plaintiffs pleaded that the revised Defence and Counterclaim did not comply with Gilligan J’s Order and reserved the right to apply to have the allegedly non-compliant parts struck out in advance of or at the hearing of the proceedings.

 

18.         It seems that the matter was listed for trial in October 2018. Shortly before that, the defendant sought discovery of 74 categories of documents and a motion for that discovery came on for hearing in the vacation list on the 9th September 2018. It could not be dealt with on that day and Keane J adjourned it to the trial of the action on the 4th October 2018.

 

19.         The motion and the substantive action came on for hearing before Ní Raifeartaigh J on that date. On the second day, following the opening and submissions, Ní Raifeartaigh J delivered a ruling in relation to, inter alia, what she described as the “actual acute conflict in this case as to the scope of the issues in the case and correspondingly the proper scope of discovery.” It is worth quoting from Ní Raifeartaigh J’s ruling but it is important to note that she recorded that counsel on behalf of the plaintiff “stated in court that the Plaintiff is not pursuing its pleaded claim for damages, which therefore removes the need for the Court to consider past events, in particular the factual events between the receipt of the Plaintiff of the CD and … issue of material and the date of the interim courts orders being made.” She went on to say that:

 

“Thus, I have a situation where each side has an entirely different view as to the scope of the issues which are properly before the Court. On my relatively short acquaintance with this case, my first impression is that the Plaintiff is correct in many of its submissions and the Defendant is seeking in her revised defence and counterclaim, and her subsequent discovery motion, to go far beyond what Gilligan J. envisaged as the appropriate parameters of the case; and further, that in her counterclaim, she seeks to make a very broad case which may not necessarily be suitable for trial within the same timeframe as the plaintiff’s claim since it may raise issues of an entirely different nature and of a much broader scope than the narrow case made by the Plaintiff entails.”

 

20.         She then went on to deal with the procedural issues which had arisen:

 

“I therefore propose to fix a timetable in which a number of steps can be taken in a logical sequence which will enable the parties to do as much work on papers, outside of court hearing time as possible, so that the issues are netted down in a suitable manner for efficient use of court time in the future.

 

I propose in the first instance to fix a timetable in preparation for the hearing of the motion to be issued by the Plaintiff and whether certain paragraphs of the revised defence and counterclaim should be struck out. The Court will then rule on this in order to finalise the defence and counterclaim definitively and the final version of the defence and counterclaim should be submitted to the Court by the Defendant for approval before filing, in order to avoid a repetition of the problem which arose in relation to the order of Gilligan J. I will allow two weeks for motion papers and legal submissions and I will fix the hearing of the motion for 8th November 2018, and that should take no more than half a day. Depending on the outcome of the case it may be necessary for the reply to be revised.

 

The Court will then give directions as to how the discovery motion is to be dealt with. The Defendant may need to reconsider what categories of discovery she is pursuing in light of whatever ruling the Court may make on the pleadings. I would anticipate the discovery hearing should be fixed for a half day hearing also…

 

…The situation in this case is unfortunate, particularly in terms of the costs that have been incurred because the trial date was vacated. I note that the Plaintiff made it clear in court yesterday that their claim is now a very narrow one and that the Defendant could easily avoid a hearing on it if she were to agree to the injunctive reliefs sought because they are no longer pursuing their claim in damages. I enquired of the Defendant yesterday what her position was in this regard and she was emphatic that she wished to oppose the injunctive reliefs sought. It is her entitlement to litigate this issue but, as I’m sure she’s aware, if the reliefs are ultimately granted, there will be cost implications down the road.

 

I think it is important to place this on the record at this point in time, the narrowness of the reliefs now sought by the Plaintiff, including the abandonment of their claim for damages and the fact that the Defendant has refused to consent to the permanent injunctive reliefs at this point in time.

 

I hope by setting out the timetable as described above, future decisions on costs will be facilitated insofar as the costs of different aspects of the case will be transparent. If the parties are agreeable, I will retain seisin of the case, case manage the mater to trial, hopefully within these legal terms.”

 

21.         In fact, Ní Raifeartaigh J was unable to retain seisin of the matter and the motion in relation to the proper scope of the defendant’s Defence was heard by Pilkington J who delivered judgment on the 2^nd June 2020. Pilkington J determined that the Revised Defence and Counterclaim was not in compliance with the Order of Gilligan J (as upheld by the Court of Appeal) and identified the paragraphs which would be allowed stand.

 

22.         I am told by Counsel for the plaintiffs that the defendant appealed that to the Court of Appeal, that an ex-tempore judgment was delivered on the 1^st March 2021, that during that hearing the Court of Appeal queried whether the plaintiff was maintaining a claim on foot of the Data Protection Acts and that the plaintiffs confirmed that they were not. This was not contested by the defendant before me. The Court of Appeal directed the plaintiffs to deliver an amended Statement of Claim to reflect that. The Court also directed the defendant to deliver an amended Defence and Counterclaim by the 30^th April in accordance with the Court of Appeal Order.

 

23.         The plaintiff delivered an Amended Statement of Claim on the 9^th March 2021. However, certain deletions which were required by the Court of Appeal to be made in light of the plaintiffs’ indication that they were not pursuing a claim for damages and that they were not pursuing any claim on foot of the Data Protection Act had not been made and the plaintiffs delivered a Re-Amended Statement of Claim on the 22^nd April 2021.

 

24.         I understand that there was some interaction between the parties about the delivery by the defendant of a compliant Defence and Counterclaim. Ultimately, Allen J admitted the proceedings to case management on the 18^th October 2021 and directed the defendant to deliver a Defence and Counterclaim that was in compliance with the Order of the Court of Appeal. Ultimately, the plaintiff provided the defendant with a draft Amended Revised Defence and Counterclaim which they said was in compliance with the Order of the Court of Appeal and Allen J directed on the 31^st March 2022 that this would stand as the defendant’s Defence and Counterclaim.

 

25.         The plaintiffs delivered an Amended Reply and Defence to Counterclaim on the 7^th April 2022.

 

26.         Thus, while the earlier pleadings may be relevant to certain matters, the pleadings which are directly relevant to the defendant’s current applications are the Re-Amended Statement of Claim delivered on the 22nd April 2021, the Amended Revised Defence and Counterclaim identified as the relevant Defence and Counterclaim by Allen J on the 31st March 2022 and the Amended Reply and Defence to Counterclaim delivered on the 7th April 2022.

 

27.         The deletions from the original Statement of Claim (quoted above) were:

(i)            Paragraph 12 - “Further and/or in the alternative, the Defendant was under a statutory obligation not to process the Confidential Information other than in accordance with the provisions of the Data Protection Acts”;

(ii)           the words “and in breach of the provisions of the Data Protection Acts” from paragraph 14;

(iii)         the “Additional Particulars of Breaches of Data Protection Acts” from paragraph 14;

(iv)         the words “and in breach of the statutory duty, through the unlawful processing of personal data” from paragraph 15;

(v)          the injunction sought at paragraph 2 of the Reliefs “restraining the Defendant (and any person having notice of such Order) from processing any personal data (other than the Defendant’s own personal data) provided to the Defendant by the Plaintiffs, or either of then, other than in accordance with the provision of the Data Protection Acts”;

(vi)         the claims for damages made in paragraph 6 and 7 of the Reliefs.

 

28.         In light of these amendments, no claim on foot of the Data Protection Acts and no claim for damages on any basis are being advanced. The defendant makes complaint about the removal of any claims based on the Data Protection Act after them being included for six years. It seems to me that this is not a matter which I have to determine on these applications. That may have certain costs implications but what I have to decide is whether to direct the delivery of further particulars and whether to direct discovery. They must be determined on the basis of the current pleadings albeit against that procedural backdrop.

 

29.         The defendant delivered a Notice for Particulars on the 24^th April 2019 “of these matters set forth in the Plaintiffs Amended Statement of Claim delivered 9th day of March 2021 and a re-amended Statement of Claim delivered 22nd day of April 2022.” The plaintiffs replied on the 18th May 2022.

 

30.         By order of this Court of the 19th May 2019 a hearing date of the 24th January 2023 was fixed for the substantive action. The defendant contended that the matter was not ready for trial as she was seeking further particulars and discovery. In light of the fact that the matter had been ongoing since 2016 and that it had previously come on for hearing but could not proceed for the reasons discussed above, I directed that the defendant should raise any Notice for Further and Better Particulars within one week of the 19th May and that the plaintiffs should furnish their replies within a week of receipt of any Notice for Further and Better Particulars. I also directed that any request for voluntary discovery should be made within one week of receipt by the defendant of the plaintiffs’ reply to any Notice for Further and Better Particulars and that the plaintiffs should reply to the request for discovery within a period of one week thereafter. I also gave the defendant liberty to issue motions by the 27th June 2022.

 

31.         The defendant raised a Notice for Further and Better Particulars on the 27^th May 2022, in which she required “further and better particulars in response to the Plaintiffs replies delivered 18th May 2022 to the Notice for Particulars delivered 22d April 2022.” Replies to this Notice for Further and Better Particulars were delivered on the 3rd June 2022.  It is this Notice of the 27^th May 2022 and the Replies thereto on the 3^rd June 2022 which form the basis of the motion in respect of particulars

 

32.         The defendant served a request for voluntary discovery on the 9th June 2022 seeking 24 categories of discovery. The plaintiffs, by letter of the 17th June 2022, effectively declined to make discovery. The defendant issued a motion. She did not do so by the date which had been directed but she explained why this was and no issue was taken by the plaintiffs. The Notice of Motion is in very unusual terms but both parties dealt with the matter as a motion for discovery and I have approached it in this way also.

 

 

Notice for Further and Better Particulars

 

33.         It seems to me that in the circumstances the best way of dealing with the defendant’s motion is to consider each individual paragraph in turn. Of course, the Court’s function is to determine the particulars actually sought by the defendant rather than whether other particulars could have been sought and perhaps directed.

 

34.         Before considering the individual particulars, it may be helpful to recall that (i) the general principle is that particulars or further and better particulars will be ordered if they are necessary to clarify the issues so that the party requesting them can know the case they have to meet or if there is a danger that they may be taken by surprise at the trial of the action, and will not be ordered where the party seeking the particulars knows the broad outline of the case he or she has to meet, (ii) the Court does retain a broad discretion to order particulars in the interests of fairness, and (iii) particulars of matters which are not alleged in the pleadings can not be obtained.

 

35.         It may also be helpful to address the general overarching point(s) made by the defendant in respect of the need for further and better particulars. In summary the plaintiff makes a number of points: (i) the legal basis for the plaintiffs’ claim is “undefined” since they withdrew the Data Protection Act basis for their claim; (ii) the plaintiffs are pursuing the same legal remedy notwithstanding that the “substantive case” was removed at the appeal hearing in March 2021 (the “substantive case” being the case grounded on the Data Protection Acts; (iii) the order which is being sought by the plaintiffs encompasses “personal data” of third parties and since the amendment of the Statement of Claim to withdraw the case grounded on the Data Protection Acts the Statement of Claim is “now absent all legal basis for the pursuit of a permanent injunctive order for that personal data”; (iv) the defendant is entitled to know whether the plaintiffs are continuing the seek relief in respect of third parties’ personal data, and, if so, the legal and factual basis upon which that relief is sought.

 

36.         It seems to me that some of these points are misconceived in a number of respects. Firstly, they seem to be based on the belief that the breach of confidence case is somehow new to the proceedings and that the original claim was based entirely on the Data Protection Acts. It is absolutely clear from a review of the original pleadings that the breach of confidence claim has always been a central part of the proceedings (see the discussion in paragraphs 10-13 above). Secondly, the defendant’s arguments appear to be fundamentally based on the belief that because data may fall within the definition of “personal data” within the Data Protection Acts, relief in respect of its disclosure can only be sought and granted under Acts and because that part of the case grounded on the Acts has been withdrawn the Statement of Claim does not disclose any legal basis for the plaintiffs’ claim because a breach of confidence can not be a legal basis for such relief. That puts the cart before the horse. That will, in fact be one of the central issues in the proceedings themselves. In fact, what the defendant is implicitly saying is that because a breach of confidence claim can not ground a claim for relief in respect of “personal data” the Statement of Claim does not give particulars of any proper claim. But whether the breach of confidence claim is a proper claim that is an issue which will have to be determined in the proceedings. There may or may not be any merit to this case and I express no view in relation to it. That is a matter for the trial. At this stage, all that is to be decided is whether the Statement of Claim gives particulars of the claim that is being made.

 

37.         Turning then to the individual paragraphs and the particulars sought. I have quoted the request contained in each paragraph as headings. The paragraphs in the Notice for Further and Better Particulars also contain a summary of the reasons why the particular is sought. I have considered these but do not believe that it is necessary to quote them in the headings (save in some cases) though I discuss them below the heading where necessary:

 

 

 

 

1.   Please give further and better particulars that the CD disclosed to the Defendant is available for trial.

 

 

38.         This simply does not constitute a request for particulars of the plaintiffs’ claim. The purpose of pleadings and particulars is to give the details of the factual and legal basis of a claim (or defence) so as to define the issues so the other party will know what case they have to meet. The purpose of seeking further particulars is to clarify those issues. A request for confirmation that the other party is in possession of a specific piece of potential evidence is not a request for further particulars. 

 

 

2.   Please give further and better particulars of paragraph 4 of the Statement of Claim and confirm that the ‘data access request’ which gave rise to the data breach in September 2015 was to Mr. Stephen Tennant as appointed receiver.

 

39.         Paragraph 4 of the Re-Amended Statement of Claim states:

 

“By Deed of Appointment dated 26 August 2013, Stephen Tennant, an insolvency practitioner and director of the Second Plaintiff was appointed as receiver over certain assets of the Defendant.”

 

40.         The particular which is sought in paragraph 2 does not in fact arise from anything pleaded in paragraph 4 of the Re-Amended Statement of Claim. The reason given by the defendant for seeking this particular is that “this request directly affects the defence in that the Plaintiffs claim the data access request was to them, which it is not.”

 

41.         While the defendant cites paragraph 4 of the Re-Amended Statement of Claim and I am satisfied that the particular sought and the reason given do not relate to paragraph 4, I have considered whether any need for this particular arises from paragraph 5, in which it is pleaded:

 

“On 14 January 2015, Grant Thornton received notification from the Data Protection Commissioner of a data access request made by the Defendant to Grant Thornton pursuant to section 4 of the Data Protection Acts 1988 and 2003 (“the Data Protection Acts”) seeking copies of any personal data kept by Grant Thornton concerning the Defendant” and paragraph 6, in which it is pleaded: “On 11 September 2015, in response to the Defendant’s data access request, Grant Thornton furnished the Defendant with a CD (“the CD”) containing certain information and documents.”

 

42.         No issue is joined in respect of these paragraphs in the Amended Revised Defence and Counterclaim. There is, therefore, no dispute disclosed between the parties in the pleadings in relation to whom the data access request was directed and there is, therefore, no need to or basis for directing this particular.

 

 

3.   Please give further and better particulars of the communications with the Office of the Data Commissioner in relation to the Defendant’s data access request set out by paragraph 5 of the Statement of Claim

 

43.         Paragraph 5 is quoted in the preceding paragraph of this judgment.

 

44.         The defendant states that “It is not adequately pleaded in that the Plaintiffs were (a) issued a data access request and (b) claim that they were only aware of the data request on 14th January 2015, which is incorrect.”

 

45.         No issue is joined in the pleadings in respect of the contents of paragraph 5 of the Re-Amended Statement of Claim. This determines the issue as that is the only basis upon which the defendant relied in seeking these particulars. However, in light of the fact that the defendant is a litigant in person (albeit an extremely experienced one) I also considered whether these particulars may arise from any other part of the pleadings.  Initially it seemed to me that they might arise under paragraph 1 of the Amended Revised Defence and Counterclaim where it is pleaded that “[T]he Defendant claims substantial damages pursuant to Section 7 of the Data Protection Acts (“the Acts”) for the Plaintiffs failure ti provide the Defendant’s data access request within the Statutory time permitted or within any reasonable time at all, in violation of and contrary to Section 4 of the Acts and consequently in violation of the Defendant’s fundamental rights as enshrined in Article 8, which concealed material facts from the Defendant and had a consequential detrimental effect on the Defendant’s litigation.”  However, the plea that the plaintiffs failed to respond to the defendant’s data access request within the time limits in section 4 of the Data Protection Acts is admitted in paragraph 11 of the Reply and Defence to Counterclaim. It seems to me therefore that there is no basis for directing a reply to paragraph 3.

 

 

4.    Please give further and better particulars where the Plaintiffs Grant Thornton Corporate Finance Limited or Grant Thornton [A Firm] received a data access request to provide copies of personal data concerning the Defendant. [Emphasis in original]

 

46.         While the defendant claims that this request “goes to the heart of the defence in that the Defendant did not issue the Plaintiffs a data access request and further, the Plaintiffs locus standi to issue same is in question as pleaded in the proceedings”, there is no basis for this claim in the pleadings.

 

47.         It is in fact difficult to understand the point being made by the defendant. It would seem to be related to the point made in respect of particular 2, i.e., that the data access request was made to Mr. Stephen Tennant. This is not raised as an issue in the pleadings and is therefore not an issue in the case.  It is also significant that while the defendant seeks these particulars on the basis that she did not make a data access request of the plaintiffs, she admits, in paragraph 8 of the Amended Revised Defence and Counterclaim, “to issuing a data access request under Section 4 of the Data Protection Acts 1988 & 2003.”  This may, of course, have been intended to refer to a data access request to Mr. Stephen Tenant but it is further significant, in any event, that in her Counterclaim the defendant seeks damages from the plaintiffs for having failed to “provide the Defendant’s data access request within the Statutory time permitted …” It is at least implicit in this that a data access request was made to the plaintiffs.

 

 

5.    Please identify and/or give further and better particulars of the meaning and scope of ‘legally privileged information’ as disclosed to the defendant.

 

48.         This seems to be raised on foot of paragraph 7 of the Re-Amended Statement of Claim in which it is pleaded, inter alia, that the CD “contained…. confidential proprietary information of Grant Thornton, including material which was legally privileged.”

 

49.         I am satisfied that this is adequately particularised. I can see no basis for an obligation to set out the “meaning and scope of ‘legally privileged information” by way of particulars.

 

50.         Furthermore, and importantly, the defendant does not at any stage in the Revised Defence and Counterclaim deny that the CD contained legally privileged information of the plaintiffs. She does deny “knowing the existence, scope and/or extent of any information that may have been classified as…’legally privileged’ or that she could have been aware or ought to be aware of the Plaintiffs intention for the information, later identified as…’legally privileged’ information in relation to the Plaintiffs and their business.” but that dispute goes to the question of the defendant’s state of knowledge and not to the question of the status of the information which is what the particular sought is concerned with.

 

51.         Most significantly, however, is that the defendant has at all times indicated that she is prepared to give an undertaking in respect of the plaintiffs’ proprietary information. This information includes the alleged legally privileged information and, therefore, in light of the defendant’s indication that she has no difficulty in giving such an undertaking there is no basis for directing that further particulars of the meaning and scope of ‘legally privileged information’ be provided.

 

 

6.    Please give further and better particulars of the legal basis the Plaintiffs rely on for custody and control of the Defendant’s personal data and response to the Defendant’s data access request.

 

52.         The defendant claims that this goes to the heart of the defence in that the Plaintiffs had personal information to which they were not entitled.

 

53.         This is not a basis for directing these particulars. Nor is it accurate to say that the question of whether the plaintiffs had personal information to which they were not entitled goes to the heart of the defence because as a matter for fact. It is not pleaded that the plaintiffs had personal information to which they were not entitled and it is, therefore, not an issue in the proceedings.

 

54.         Furthermore, the plaintiffs’ claim concerns alleged or potential disclosure of third parties’ information by the defendant. It can not be a defence to that claim for the defendant to say that the plaintiffs were not entitled to be in possession of the defendant’s personal information and, therefore, the particular sought can not be necessary to allow the defendant to meet the case being made.

 

 

7.    Please give further and better particulars regarding the Defendant’s notification of a data breach in or around October 13^th, 2015, where the Plaintiffs response is …”as I understand it the issue of Ms. Scanlan receiving third party documents has nothing to do with her there is nothing to say to Ms. Scanlan as she has received her records.” [emphasis in original]

 

 

55.         The defendant states that “In light of paragraph 17 of the Statement of Claim this inquiry goes to the heart of a defence to breach of confidence in that the Plaintiff were unconcerned as to the disclosure of data to the Defendant and sought to avoid all interaction with the defendant notwithstanding their claim of confidence.”

 

56.         Paragraph 17 of the Re-Amended Statement of Claim pleads:

 

“In the premises, Grant Thornton was compelled to bring these proceedings and to seek interlocutory injunctive relief from this Honourable Court.”

 

57.         As is clear from the opening words of that paragraph, it must be read along with what preceded it. Paragraph 16 of the Re-Amended Statement of Claim states:

 

“Despite having been requested to do so on numerous occasions both by Grant Thornton and by Solicitors acting on their behalf, the Defendant refused to return the Confidential Information to Grant Thornton and/or refused to confirm that the Confidential Information had not been shared and/or that all copies of the Information had been deleted. In this regard, reference will be made at the hearing of these proceedings to the correspondence which passed between Grant Thornton and its solicitors on the one hand and the Defendant on the other in the period from 13 October 2015 to 27 November 2015.”

 

 

58.         I am satisfied that it is absolutely clear what case the plaintiffs are making in these paragraphs and further particulars are not required.

 

59.         The defendant is perfectly entitled to cross-examine the plaintiffs at the trial on the basis of the alleged statement contained in the quote in paragraph 7 of the request for particulars to seek to establish that the plaintiffs were unconcerned as to the disclosure of data and that this is inconsistent with the case that they seek to make that they were “compelled to seek interlocutory injunctive relief” from the Courte plaintiffs claim to have been “compelled” to apply to Court is perfectly clear.

 

 

8.    Please give full and better particulars of the Plaintiffs subsequent inquiry on notification of the data breach and where the Plaintiffs identified that the disclosed information was company confidential information comprising of proprietary and legally privileged information.

 

60.         It is in fact unclear what is being sought in this paragraph.

 

61.         The defendant explains that it is sought for the same reason as particular 7, that it “goes to the heart of a defence to breach of confidence in that the plaintiffs were unconcerned as to the data disclosure and sought to avoid all interaction with the defendant.”

 

62.         It seems to me that my comments in respect of particular 7 are applicable here also.

 

63.         I also understand it to seek particulars of any inquiry/investigation/assessment by the plaintiffs which led to them concluding that the information which had been disclosed was “company confidential information”.

 

64.         The particular sought does not arise from the pleaded case and is, in any event, unnecessary for the defendant to understand the case being made.

 

65.         That case is that information was disclosed to the defendant which was confidential and one type of information was company proprietary and legally privileged information. The information either meets that description or it does not and the inquiry/investigation/assessment by the plaintiffs when they became aware of the disclosure can not be determinative of that. The plaintiffs’ case in this respect is clear and further particulars are not necessary for the defendant to understand the case that she has to meet.

 

66.         Furthermore, in circumstances where, as discussed above, the defendant has indicated all along that she is prepared to give an undertaking in respect of the “company information” it is impossible to see what issue in the proceedings requires these particulars.

 

 

 

9.    Please give detailed and better particulars of the Defendant’s presumed and/or required understanding, knowledge and/or legal obligations (or otherwise) for the disclosed data in light of paragraph 8 of the statement of claim that “upon receipt of the Confidential Information, the Defendant knew, or ought to have known, that the Confidential Information was not the Defendant’s personal data, within the meaning of section 1 of the Data Protection Acts and that the release of the Confidential Information to her was unintended.” And further at paragraph 10 “that in the premises, at all material times following the receipt of the Confidential Information, the Defendant knew or ought to have known that the Confidential Information was confidential information belonging to Grant Thornton which had been released to her in error. Further, the Defendant knew, or ought to have known, that she had no entitlement to receive, retain or publish the Confidential Information.”

 

67.         The basis for seeking these particulars is misconceived. The defendant describes paragraph 8 and 10 of the Statement of Claim as being based on a “presumed understanding” on the part of the defendant. That is to misunderstand the purpose of pleadings. Paragraphs 8 and 10 allege or assert that the defendant “knew, or ought to have known” certain things. They do not make a presumption that she knew or ought to have known but make the case that she knew or ought to have known those things. It is a matter for the plaintiffs to prove those allegations.

 

68.         As discussed above, particulars will be directed where it is necessary to clarify any issue or where the defendant does not or can not know from the pleadings what case she has to meet. In my view the case that she has to meet, or to put it another way the case that the plaintiffs have set themselves to have to prove, is perfectly clear. There is, therefore, no basis for directing this further particular.

 

69.         It is also somewhat difficult to understand the defendant’s position in respect of paragraph 8 of the Re-Amended Statement of Claim (which is quoted in the particular sought). Paragraph 8 pleads that the defendant knew or ought to have known that the Confidential Information was not her personal data. The defendant admits in paragraph 6 of the Amended Revised Defence and Counterclaim that the “CD comprised more than the Defendant’s personal data…” She also admits in the same paragraph that the “release of information outside the scope of their data access request was unintended.” The defendant does, of course, deny that she knew or ought to have known anything about the information or what was intended for the information but in circumstances where she admits that the information contained data/ information, which was not hers, i.e., what is pleaded in paragraph 8, it is difficult to see how she can seek further particulars of what is pleaded there.

 

 

 

10.  Please give further and better particulars of the Plaintiffs’ legal ownership and authority for and over the ‘confidential information’, comprising primarily of personal data property within the meaning of the Data Protection Acts 1988 & 2003 and reported as a data breach to the office of the Data Commissioner 24^th November 2015. [Emphasis in original]

 

70.         The defendant claims that this goes to the heart of a defence to breach of confidence and the plaintiffs claim that the defendant understood data protection law and her legal obligation in this regard and that the plaintiffs could not in any event pursue Section 7 damages pursuant to the Data Protection Acts 1988 & 2003 because they are not entitled to damage for data privacy (personal right) for others’ personal data, unlawfully disclosed in the first instance by the plaintiffs.

 

71.         This is where the procedural history set out above is of significance. During the course of the proceedings the plaintiffs have stated that they are not pursuing any claim for damages and are not seeking any relief under the Data Protection Acts and the current pleadings do not contain any claim under those Acts. While there is passing reference in the reasons given for these particulars to a defence to a breach of confidence, the reasons given for seeking the particulars all in fact relate to data protection law and damages under section 7 of the Data Protection Acts. It seems to me, therefore, that they relate to issues which are no longer live in the case.

 

 

 

11.  Please give further and better particulars of the nature of the legal right and remedy claimed by the Plaintiff over the disclosed personal data… Please particularise the legal basis of the Plaintiffs legal standing to continue to claim orders for or over personal data and the law now supporting that pursuit

 

72.         It is worth quoting in full the reasons given by the defendant for seeking these particulars.

 

73.         She states:

 

“This is not adequately pleaded in light of the Plaintiffs continued pursuit of the interim order over personal data…The legal basis of [the pursuit] was removed by the Court of Appeal. To maintain and justify this legal pursuit, the Plaintiffs are required to identify the Defendant’s legal offences with personal data. This is fundamental to a statement of claim in pursuit of legal remedy (damages or otherwise) or the defendant cannot adequately defend their position.”

 

74.         I am entirely satisfied that the plaintiffs’ claim in this regard is adequately pleaded. They rely on and plead breach of confidence and breach of duty as the legal basis for seeking relief and particulars are given in paragraphs 10, 11 and 14 of the Re-Amended Statement of Claim. They may be correct or incorrect. They may obtain the relief on that basis or be refused that relief. They may succeed or fail to prove the necessary ingredients of the wrongs alleged or the defendant may succeed in showing that the tort of breach of confidence does not apply to “personal data”. In short, there may be no merit to the plaintiffs’ case but it is absolutely clear what that case is and, in those circumstances, there is no necessity for further particulars.

 

 

 

12.  Please give further and better particulars and/or identify the legal basis and/or Defendant’s legal wrongs/offences with personal data and company data supporting the continued pursuit and procurement of a permanent injunctive order and in light of the Defendant’s offer for a legal undertaking over company data. Please see para 10 in this regard.

 

75.         I am also entirely satisfied that the plaintiffs’ claim in this regard is adequately pleaded for the reasons set out in respect of paragraph 11.

 

 

13.  Please give further and better particulars and/or identify what Data Protection Law the Plaintiffs rely on for a permanent injunctive order over the personal data disclosed reported as a data breach to the Office of the Data Commissioner 24^th November 2015.

 

76.         The defendant states:

 

“The Plaintiffs refuse or fail to identify how they are permitted to pursue personal data offences to claim legal remedy for same. The Plaintiffs fail or refuse to identify if they pursue legal orders for personal data pursuant to GDPR (Data Protection Act 2018). The Plaintiff confirms only that they don’t pursue the former Data Protection Acts and damages pursuant to Section 7. The Plaintiffs in any event were not entitled to damages claim over others personal data.” [Emphasis in the original]

 

77.         I am also satisfied that the plaintiffs’ case is adequately pleaded for the same reasons as set out in relation to particulars 11 and 12. The plaintiffs’ Re-Amended Statement of Claim makes it clear that they rely on breach of confidence and breach of duty to ground their application for a permanent injunctive relief. They are not entitled, absent an amendment to their pleadings, to rely on any other grounds to seek that relief.

 

78.         It is clear that one of the defendants’ main contentions will be that as some of the information is “personal data” within the meaning of the Data Protections Act then the plaintiffs are not entitled to any relief on the basis of a breach of confidence or breach of duty. However, as discussed above, the merits of the parties’ respective positions are not a matter for the Court at this stage. The only issue is whether the plaintiffs’ claim is sufficiently clear and I am satisfied that it is.

 

79.         In relation to the concern that is raised by the defendant that the plaintiffs have failed to identify whether they pursue relief for personal data pursuant to GDPR (Data Protection Act 2018) it must be noted that the plaintiffs do not plead anything in relation to the GDPR (Data Protection Act 2018). In those circumstances, they are not entitled to pursue relief on the basis of this Act in the absence of an amendment to the pleadings.

 

 

 

14.  Please give full and better particulars of the ‘data breach’ identified in paragraph 13 of the Statement of Claim and/or how the nature of the Plaintiffs’ ‘confidential information’ as a personal data breach. [emphasis in the original]

 

 

80.         The defendant states that this “is not adequately pleaded and the Defence requires explanation as to the Plaintiffs understanding of a personal data breach and if company data is also included in same or otherwise”.

 

81.         Paragraph 13 of the Statement of Claim pleads:

 

“By letter dated 13 October 2015, Grant Thornton advised the Defendant that a data breach had inadvertently occurred and requested her to return the Confidential Information and not to retain any copies of it.”

 

82.         It is difficult to see what live issue remaining in the case this particular is directed towards and in those circumstances, there is no basis upon which I could direct a reply in the terms sought. However, in fact, it appears from the reason that is given that what is sought is clarification of the plea contained in paragraph 13 as to whether the term “data breach”, as used in the paragraph, includes the inadvertent disclosure of the company’s proprietary information. It seems to me that the defendant is entitled to this clarification and I will therefore direct the defendants to “Clarify whether the term ‘data breach’ as used in paragraph 13 of the Re-Amended Statement of Claim includes the inadvertent disclosure of the company proprietary information”

 

 

 

15.  Please give full and better particulars of the Defendant’s legal wrongdoing with third party data property and privacy.

 

83.         It seems to me that when the Re-Amended Statement of Claim is read as a whole there is no lack of clarity as to the legal wrongdoing that is alleged against the defendant. I do not propose to rehearse the Re-Amended Statement of Claim but in summary the defendant’s alleged wrongdoing is that she received information through error, that information contained information relating to persons other than the defendant, that she was under an obligation to maintain the confidentiality of that information and that in breach of that obligation she disclosed confidential information to third parties. That is the alleged wrongdoing that is alleged against the defendant. As discussed above, there may or may not be merit to that case but the alleged wrongdoing is clear.

 

 

16.  Please give full and better particulars of the Plaintiffs legal right asserted by this legal action for pursuit of breach of confidence for the disclosed data. Please identify where the Plaintiff breached the Plaintiffs confidence. [Emphasis in the original]

 

 

84.         There are in fact two separate limbs to this paragraph. I am satisfied that adequate particulars of both limbs are contained in the Re-Amended Statement of Claim. As noted above, it is important not to conflate the particularisation of the claim with the merits of that claim. The basis upon which the plaintiffs claim a legal right to pursue a breach of confidence claim is adequately pleaded in, inter alia, paragraphs 9-13 of the Re-Amended Statement of Claim and the claims as to when the defendant is alleged to have breached her alleged duty of confidence are pleaded in paragraph 14, including the Particulars, and paragraph 15 of the Re-Amended Statement of Claim.

 

 

 

17.  Please provide further and better particulars and/or identify the Plaintiffs legal duty of care to personal data property in circumstances set out by the Statement of Claim. Please see para 11, 12 & 13 [Emphasis in the original]

 

 

85.         I am not satisfied that these further particulars are required. The basis for the claim is set out in the Re-Amended Statement of Claim and whether the plaintiffs had any duty of care (insofar as this is even in issue - see next paragraph) is a matter for the trial of the action and, in particular, a matter for legal submissions.

 

86.         In fact, the Defence and Counterclaim does not put the existence of any duty of care to personal data on the part of the plaintiff in issue in the proceedings and the particular sought is not directed, therefore, to any live issue in the proceedings.

 

 

 

18.  Please provide further and better particulars identifying the Plaintiffs legal duty of care to company data (proprietary and legally privileged) in circumstances set out by the Statement of Claim.

 

87.         My comments in relation to paragraph 17 apply here also.

 

88.         In any event, it seems to me that this request is misconceived. I do not read the plaintiffs’ claim as asserting a duty of care over the “company data (proprietary and legally privileged)” but rather as claiming that they are entitled, as of right, to take steps to keep the plaintiffs’ own information confidential.

 

89.         Furthermore, where the defendant has not put the plaintiffs’ entitlement to protect their own information in issue and, significantly, has offered an undertaking in respect of the plaintiffs’ own information there does not seem to me to be any basis for directing this particular.

 

 

 

19.  Please provide further and better particulars of the Defendants legal wrongs arising in breach of confidence and breach of duty and the nature of Defendants legal duty in circumstances as identified by paragraph 15 of the Statement of Claim. See para 16 above. [Emphasis in original]

 

90.         I have in substance dealt with the matters sought in this paragraph. The basis for the alleged legal duty is adequately pleaded in paragraphs 6, 7, 8, 10, 11, and 13 of the Re-Amended Statement of Claim and the alleged “legal wrongs arising in breach of confidence and breach of duty” are set out in paragraph 14 (including the Particulars) and paragraph 15.

 

 

 

 

20.  Please provide further and better particulars of the Defendants unlawful disclosure and/or misuse of personal data, company proprietary data and legally privileged material to third parties, or at all claimed in paragraph 15 of the Statement of Claim. See para 16 above. [Emphasis in the original]

 

 

91.         I have previously quoted paragraph 15 of the Re-Amended Statement of Claim. It clearly relates back to the Particulars contained in paragraph 14 and, in doing so, it seems to me that the defendant is entitled to either (i) the identities of the third parties referred to in paragraph 14 and 15 of the Re-Amended Statement of Claim, (ii) confirmation that the plaintiffs do not know their identities (other than the named third parties), or (iii) confirmation that the plaintiffs are only relying on the disclosure to the named third parties and/or the making the documents available to the public at large on social media.

 

92.         The “Particulars” in paragraph 14 state:

 

“On 13 October 2015, the Defendant sent certain documents comprised in the Confidential Information to a number of third parties…

 

On 16 November 2015, Stephen Tennant of Grant Thornton received a voicemail from a further third party who subsequently informed him that the Defendant had contacted him regarding a specific document within the Confidential Information concerning this third party…

 

Grant Thornton has also received correspondence from other third parties who have in their possession documents comprising part of the Confidential Information…”

 

93.         It seems to me that the defendant would be at a distinct disadvantage in seeking to defend the case if full particulars of the “third parties” referred to in these “Particulars” were not provided if they are known to the plaintiffs. It may be that these have been identified in correspondence between the plaintiff and the defendant or in the voluminous affidavits that have been exchanged but the Court has no evidence of this and the plaintiffs do not resist giving these particulars on the basis that they are already known to the defendant.

 

94.         I have considered whether these details are really more matters for evidence but it seems to me that they are appropriate matters for particulars. The plaintiffs’ case is that the defendant is guilty of breach of confidence and breach of duty in disclosing information to persons and it seems to me that the particulars of the persons to whom that disclosure is alleged to have been made is a proper matter for particulars.

 

 

95.         I will therefore direct the plaintiffs to provide the following:

 

“(i) the identities of the third parties referred to in the “Particulars” section of paragraph 14 and in paragraph 15 of the Re-Amended Statement of Claim;

 

(ii) in the alternative, confirmation that the plaintiffs do not know the identities of those third parties; or

 

(iii) confirmation that the plaintiffs are only relying on the disclosure to the named third parties (Mr. Gerard Scriven and Mr. Wiliam McKeogh) and/or the making the documents available to the public at large on social media.”

 

 

 

21.  Please give further and better particulars regarding the lawful offence committed by the Defendant in disclosing to Mr. Kevin Brophy that his personal data was subject of a data breach

 

96.         The Court has no knowledge in relation to a Mr. Kevin Brophy. It seems likely from the terms of the paragraph and from the plaintiffs’ reply that “The Plaintiffs’ claims with regard to the Confidential Information are adequately pleaded on the Re-Amended Statement of Claim” that this is a person to whom it is alleged the confidential information was disclosed in breach of the duty of confidence and that the defendant’s response or defence to this is that she only disclosed to Mr. Brophy that his personal data was subject of a data breach.

 

97.         There is no need for any further particulars. If my understanding of the issue is correct then the defendant knows what case she has to meet, i.e., that it is alleged that there was a disclosure to Mr. Kevin Brophy which was in breach of confidence, and indeed knows what her response is. Whether the allegation (or indeed the defence) is well-founded is ultimately a matter for the trial

 

 

22.  Please give full and better particulars of “received correspondence” from third parties “who have in their possession” under the Particulars of the Statement of Claim and regarding:

 

(i)         That the email on 26^th November 2015 is the Defendants and or formed part of the data disclosure of 2015? [Grant Thornton received an email 26 November 2015 from “Research Routers”, with an email address of researchroute@yahoo.ie and email name of “Due Diligence”, attaching a document comprising Confidential Information]

 

(ii)        That letter dated 15^th 2016 is the Defendants or formed part of the data disclosure of 2015? [A letter dated 15 April 2016 was delivered to Grant Thornton’s Cor office by “A concerned member of the public” enclosing a memory stick including Confidential Information];

 

(iii)      That the letters of 10 March and 31^st March 2016 is the Defendants and or formed part of the data disclosure of 2015? [The Plaintiffs were provided with anonymous letters dated 10 March 2016 and 31 March 2016 that had been sent to Baker Tilly Ryan Glennon and Byrne Wallace, respectively, which included part of the Confidential Information];

 

(iv)      That the Facebook profile or comments are the Defendants and formed part of data disclosure of 2015? [On or around 25 and 26 November 2015, a Facebook profile under the name “Due Dilliger” posted comments that included an annotated screen shot of part of Confidential Information].

 

(v)       That the Twitter profile is the defendants and formed of the data disclosure of 2015? [On or around 25 and 26 November 2015, a twitter account under the name “Due Dilliger” tweeted the same annotated screen shot tagging the journal.ie and the Grant Thornton Ireland twitter accounts].

 

(vi)     Please identify the Defendant’s legal offences in showing Mr Scriven the disclosed data? Please particularise any subsequent threat to the Plaintiffs following Mr Scriven’s undertaking that he would not disclose any of the data personal or other that he viewed.

 

(vii)     Please identify the data, personal or company disclosed to Mr Keogh? [Emphasis in the original]

 

98.         Items (i) - (v) are not matters for particulars. They do not seek particulars of the plaintiff’s claim but rather seek to engage with various items of evidence and seek confirmations or admissions in respect of them.

 

99.         The background to this request is that in her original Notice for Particulars (paragraph 27) the defendant sought:

 

 “…full particulars of “received correspondence” from third parties “who have in their possession” under the Particulars of the Statement of Claim and regarding

 

a)    documents available to the public at large on social media and details that the Defendant is in fact responsible for such publication.

 

b)    the said documents comprise of the information as disclosed to the Defendant.

 

c)    communications with third parties regarding the disclosed personal data

 

d)    communications, meeting and undertaking provided by Mr. Gerard Scriven that personal data or any data was secure and would not be disseminated.

 

e)    actual disclosure of personal data or any data at all to a Mr. William McKeogh and the threat of exposure or any further disclosure regarding same.”

 

100.       The plaintiffs replied by stating that the requests at 27(a) - (c) were not properly particularised requests and, without prejudice to that, provided particulars, identifying the email of the 26^th November 2015, letter dated 15^th April 2016, anonymous letters of 10^th March and 31^st March 2016, postings of an annotated screenshot on a Facebook profile on the 25^th and 26^th November, and tweets of the same dates tweeting the same annotated screenshot. These formed the basis of the request for further and better particulars. It seems to me that to the extent that the plaintiffs may have been required to provide particulars on foot of the original request, they did so and, as stated above, what is being sought in this request is in fact to engage with the evidence.

 

101.       In respect of paragraph (vi) I am satisfied that the claim in respect of the defendant’s disclosure to Mr. Scriven is adequately pleaded. It will be a matter for the plaintiffs to establish that this amounts to an “offence”, ie. a breach of confidence and/or a breach of duty. It will also be a matter for evidence and submissions for the plaintiffs to establish if there is a future or ongoing threat to the plaintiffs such as to warrant an injunction.

 

102.       In relation to paragraph (vii) it seems to me that the defendant is entitled to particulars of the information which it is alleged she disclosed to Mr. McKeogh. My comments in respect of paragraph 20 and the entitlement to particulars of the identity of persons referred to as “third parties” in the “Particulars” also apply here. I will therefore direct that the defendants’ identify the data, personal or company, disclosed to Mr. McKeogh

 

 

 

23.  Please give further and better particulars of any and all disclosures of the information disclosed to the Defendant as in the Statement of Claim ‘Particulars’… Please identify all others in receipt of this disclosed data or part of the disclosed data and the legal measures taken regarding same. [Emphasis in original]

 

103.       The defendant states that “the disclosed data was not only released to the defendant” so it seems that the reason for seeking these particulars is to enable the defendant to show that the information was disclosed to others and they could have disseminated it rather than the defendant.

 

104.       That is not the purpose of particulars. The plaintiffs’ case is clear - the defendant received information and disclosed it to other persons. The information sought in this paragraph does not seek particulars of that claim but rather seeks information or evidence which the defendant would like to employ in her defence.

 

 

 

24.   Please give further and better particulars on how it is alleged that the said disclosed information was unlawfully misused and/or in dereliction of the Defendant’s legal duty to the Plaintiffs, the data itself and/or other third parties in the Statement of Claim ‘Particulars’. [Emphasis in original]

 

 

105.       The defendant states that “this is not adequately particularised, to defend this claim, the Plaintiffs must identify the Defendant’s unlawful activity with personal and company data and the law on which the Plaintiffs rely to identify how that constitutes misuse within the meaning of the law.”

 

106.       This is simply a reframing of the particulars sought above as to the alleged “wrongdoing”, including in paragraph 11, 12, 15 and 19, etc and my comments in respect of those particulars apply.

 

 

 

25.  Please give further and better particulars of the Plaintiffs legal ownership and authority of the personal data officially reported to the Office of the Data Commissioner on 24^th November 2015…Please identify the basis of legal ownership and standing for personal data property.

 

107.       The defendant states that this “goes to the heart of the defence in that the Plaintiffs pursue legal orders (and claimed damages) for personal data property. Therefore, the Plaintiffs claim ownership and standing in inter partes proceedings to claim orders.”

 

108.       The particulars sought in this paragraph do not arise from the case that is pleaded in the Re-Amended Statement of Claim. It is not pleaded that the plaintiffs have “legal ownership and authority over the personal data officially reported to the Office of the Data Commissioner.”

 

109.       To the extent that what is sought is the basis upon which the plaintiffs claim to be entitled to maintain proceedings and obtain relief in respect of the alleged unlawful disclosure of information relating to third parties that is adequately pleaded in the Plenary Summons and Re-Amended Statement of Claim. The Court may, of course, ultimately determine that this basis is not well-founded and that the plaintiffs are not entitled to maintain the proceedings or obtain relief in relation to the alleged disclosure information but that this is not the test in respect of an application for further and better particulars.

 

 

26.  Please give further and better particulars of the communication between the Data Commissioner’s Office and the Plaintiffs about the Defendant regarding the data access, data breach, and the Defendants alleged offences against personal data…Please identify the Data Commissioner’s response to the Plaintiffs assertions on 24^th November 2015 that the Defendant had legal obligations to personal data pursuant to Section 2 & 22 of the Data Protection Acts 1988 & 2003 and that the Plaintiffs were to enforce the said Acts regarding same.[Emphasis in original]

 

 

 

110.       The defendant states that this goes to the heart of the defence “in that the Defendant asserts that they have no legal obligations, duty of care or statutory duty to personal data verified by the data commissioner in April 2016.”

 

111.       I am satisfied that these particulars should not be directed for two reasons. Firstly, the particulars do not arise from the case that is pleaded on behalf of the plaintiffs in circumstances where the plaintiffs are not maintaining any claim under or on foot of the Data Protection Acts 1988 & 2003.

 

112.       Secondly, the stated reason why the particulars are sought is for the defendant to show that the Data Commissioner held that the defendant had no legal obligations to personal data pursuant to section 2 & 22 of the Data Protection Acts. That can not be determinative of the plaintiffs’ claim which is brought under the common law breach of confidence and breach of duty. The Commissioner’s decision or view as to the parties’ respective rights and obligations under the Acts can not determine their obligations under the tort of breach of confidence.

 

 

 

27.  Please provide further and better particulars of the Plaintiffs contract/or agreement, which placed the Defendant in a position of confidence (for breach of confidence) with the Plaintiffs regarding personal or company data or any data at all. This goes to the heart of breach of confidence claims. The Defendant is entitled to know when, where and how the Plaintiffs and Defendant understood the legal obligation of confidence in order to breach the Plaintiffs confidence. This does not need to be a written contract/agreement. It may be an oral understanding between the parties, but in any event, the Defendant requires particulars of that established understating.

 

a.   The date of contract/agreement;

 

b.   The parties who concluded the agreement/ contract;

 

c.   Whether the contract/agreement was concluded orally or in writing;

 

d.   That the Defendants personal data (or others as disclosed) was company property and thus company confidential information

 

e.   If concluded orally, the time, date and venue at which the contract/agreement was made;

 

f.    If concluded in writing, identify the written contract/agreement and furnish a copy to include terms and conditions particularly relating to the Defendant’s expected and required confidences.

 

g.   A relationship identifying the Plaintiff took the Defendant into their confidence regarding information in their custody and/ or the confidential information (the CD) in question

 

h.   Notification to the Defendant regarding any information disclosed or in their custody or the consequences, sanctions and penalty same. [Emphasis in original]

 

113.       These particulars do not arise on the pleaded case. The plaintiffs have not pleaded any contract or agreement between the parties and thus particulars of such a contract or agreement simply does not arise.

 

114.       To the extent that what is sought by the plaintiff is particulars of the basis upon which the plaintiffs claim that the defendant owed a duty of confidence (as appears to be the case from paragraph (g) and (h) and indeed from the statement that the “Defendant is entitled to know when, where and how the Plaintiff and Defendant understood the legal obligation of confidence in order to breach the Plaintiffs confidence”) that is adequately particularised in the Re-Amended Statement of Claim, as discussed above. Again, the merits of what is claimed in paragraphs 7 - 13 is a matter for determination at the trial.

 

 

 

28.  Please provide further and better particulars of the Defendants refusal to return the CD to the Plaintiffs.

 

 

115.       This is sought on the basis that the Defendant claims that she never refused to return the CD.

 

116.       In their reply to the defendant’s original Notice for Particulars, the plaintiffs stated that they “will rely on the correspondence which passed between Grant Thornton and its solicitors on the one hand and the Defendant on the other in the period from 13 October to 27 November 2015 at the trial of these proceedings”.

 

117.       It seems to me that this, together with the plea in paragraph 16 of the Re-Amended Statement of Claim, provides adequate particulars of the case that the defendant refused to return the CD. Of course, it will be a matter for the trial judge to determine whether the defendant did in fact refuse to return it.

 

 

29.  Please give further and better particulars as to any legal deficiencies or lacuna (domestic or EU) restricting or prohibiting the State Authority or data privacy from adequately protecting data privacy rights by the Data Protection Act 1988 & 2003 (EU Law 95/46/EC), the Data Protection Act 2018 (GDPR) and/or by engaging the Courts (for interim relief and/ or criminal indictment), regarding the Plaintiffs claim at paragraph 17 that they were “compelled to bring these proceedings and to seek interlocutory relief from this Honourable Court”. [Emphasis in the original]

 

 

118.       The defendant states that “This goes to the heart of the defence in that the Plaintiffs claim that they were compelled to seek private legal remedy because the State Authority and the data privacy law did not so provide for the Plaintiffs need. The Defendant is entitled to the particulars of the claim compelling the Plaintiffs to avoid the first court for personal data required by EU Law and binding Supreme Court precedent. The defendant requires (is entitled) to the particulars of law which the Plaintiffs rely on to use inter partes proceedings for personal data without the required partes. (Owners of the data property) in light of their continued pursuit for orders over personal data.”

 

119.       The particulars sought do not arise from the case that is pleaded. The plaintiffs do not plead that there are any legal deficiencies or lacuna which restrict or prohibit the Data Commissioner from protecting data privacy rights. Most importantly, they do not plead that they were compelled to bring these proceedings by any such deficiency or lacuna or because the “State Authority and the data privacy law did not so provide for the Plaintiffs need.” As discussed above, it is pleaded in paragraph 17 of the Re-Amended Statement of Claim that “In the premises, Grant Thornton was compelled to bring these proceedings and to seek interlocutory injunctive relief from this Honourable Court.” The premises or circumstances referred to in the opening words of this paragraph are set out in the preceding paragraphs of the Re-Amended Statement of Claim, culminating in paragraph 16 which states, inter alia, “Despite having been requested to do on numerous occasions both by Grant Thornton and by Solicitors acting on their behalf, the Defendant refused to return the Confidential Information to Grant Thornton and/or refused to confirm that the Confidential Information had not been shared and/or that all copies of the Information had been deleted…”

 

120.       Thus, the plaintiffs’ case is that they were compelled to bring these proceedings by the alleged acts or omissions of the Defendant and the particulars sought simply do not arise on that case.

 

121.       The defendant may well wish to argue at the trial that the plaintiffs are not entitled to the relief sought because the protection of individuals’ data is a matter for the Data Protection Acts and the Data Commissioner but no necessity for these particulars arises from the case that is made by the plaintiffs.

 

 

 

30.  Please give further and better particulars of any threat posed to personal data and/or company data, which required a six-year interim order and further requirement for a trial claiming a permanent legal order for personal and company data.

 

 

122.       I am satisfied that the basis upon which the plaintiffs are seeking the relief is clear from the Re-Amended Statement of Claim. It is expressly pleaded that the plaintiffs sought undertakings from the defendant in respect of the Confidential Information (which includes the company proprietary information and information relating or belonging to third parties) and those undertakings were not forthcoming from the defendant and that in those circumstances the relief is appropriate and necessary. The defendant has offered undertakings in respect of the company information but the undertakings that were sought were in respect of all of the Confidential Information. The plaintiffs may be correct or incorrect in their position that they are entitled to relief on the basis that an undertaking was not forthcoming but the case they are making is clear from the pleadings.

 

 

 

31.  Please give further and particulars regarding the Plaintiffs refusal to accept the Defendants six year undertaking not to disclose, disseminate or retain company data (proprietary and/ or legally privileged data). See para 31 above. [Emphasis in original]

 

 

123.       The defendant states “The defendant is entitled to a non suit against the Plaintiffs in light of the Defendant’s undertaking for company data (which is the Plaintiffs requested legal remedy) and in the absence of any legal standing to pursue orders of any description for any personal data property.”

 

124.       The reasons why the plaintiffs did not accept an undertaking from the plaintiffs is not a matter for particulars but in any event such particulars are not necessary in circumstances where the plaintiffs sought an undertaking in respect of all of the Confidential Information and the undertaking that was offered was in respect of part only of that information.

 

125.       As noted above, the defendant is entitled to make the case that the plaintiffs do not have standing to pursue or are not entitled to orders of any description for personal data property but that is a matter for the trial or a motion for a non-suit (as referred to by the defendant) rather than a matter which properly grounds an application for further and better particulars.

 

 

 

32.  Please give full and better particulars to the Plaintiffs claim of loss and damage at paragraph 23 of the Statement of Claim including but not limited to, the legal basis on which it is asserted that the Defendant is responsible and liable for same.

 

 

126.       The plaintiffs are not maintaining any claim for damages against the defendant. It is correct, of course, to say that it is pleaded in paragraph 23 of the Re-Amended Statement of Claim that by reason of the matters pleaded in the earlier paragraphs the plaintiffs have suffered loss and damage and particulars of same are given but there is no claim for damages in the Prayer. Indeed, as discussed in the chronology section above, the plaintiffs informed the Court of Appeal that they were not seeking damages and the Statement of Claim has been amended to delete any claim for damages (either for breach of confidence or misuse of private information or for breach of statutory duty including pursuant to section 7 of the Data Protection Acts).

 

127.       Thus, there is no basis for ordering the particulars sought in this paragraph.

 

 

 

33.  Please give further and better particulars of the Plaintiffs application and/or notification to the Defendant to alter/ amend/ update the Statement of Claim reissued in March and April 2021. The Defendant is entitled to the basis of the Plaintiffs discontinuance/abandonment so they may adequately defend the basis on which personal data is now pursued.  [Emphasis in original]

 

 

128.       I do not see any basis upon which the Court could direct these particulars. They are not particulars of the pleaded case but rather the reasons why the plaintiffs have chosen not to pursue aspects of their case and that is not a proper matter for particulars.

 

129.       The reason that is given by the defendant is that the defendant “…is entitled to the basis of the Plaintiff’s discontinuance/abandonment so they may adequately defend the basis on which personal data is now pursued”. I do not accept that this a basis for ordering these particulars in circumstances where I am satisfied that the basis upon which the plaintiffs are maintaining the proceedings and seeking relief in respect of information relating to third parties is adequately pleaded for the defendant to know in broad outline the case to be met.

 

130.       Thus, I will direct the plaintiffs to reply to the following particulars:

 

14.   Clarify whether the term ‘data breach’ as used in paragraph 13 of the Re-Amended Statement of Claim includes the inadvertent disclosure of the company proprietary information.

 

15.   Provide:

 (i) the identities of the third parties referred to in the “Particulars” section of paragraph 14 and in paragraph 15 of the Re-Amended Statement of Claim;

 

(ii) in the alternative, confirmation that the plaintiffs do not know the identities of those third parties;

 

(iii) further, or in the alternative, confirmation whether the plaintiffs are only relying on the disclosure to the third parties expressly named in the Re-Amended Statement of Claim (Mr. Gerard Scriven and Mr. Wiliam McKeogh) and/or the making the documents available to the public at large on social media.

 

16.   Direct that the Defendant’ to identify the data, personal or company, disclosed to Mr. McKeogh.

 

 

 

Discovery

 

131.       The defendant seeks 24 categories of discovery. The plaintiffs are agreeable to making limited discovery of one category and object to making discovery of any other categories.

 

132.       Again, it seems to me that the best way to deal with the matter is to address each category in turn. I therefore propose to set out each category and to either set out the reasons given by the defendant for each category or to address those reasons in my discussion.

 

 

1.    The CD disclosed to the Defendant in 2015 which is the subject matter of these proceedings and is proof of the nature of the disclosed data for trial.

 

133.       The reason that is given for seeking discovery is that “The Court is entitled (as is the Defendant) subject to appropriate confidentiality (interim order already in place) redactions to identify information the Plaintiffs claim comprises of privileged company data and personal data. This documentary proof was entitled to be preserved by the Plaintiffs solicitors for the trial of the Plenary action.” [Emphasis in the original]

 

134.       I do not believe that discovery of the CD is appropriate.

 

135.       Gilligan J ordered the defendant to deliver the CD up to the plaintiffs in his order of the 4^th December 2015. For discovery of the entire CD to be ordered now would essentially reverse that order. It must be acknowledged, of course, that the same potential risks in relation to dissemination may not exist at this stage because the order restraining any dissemination of the contents of the CD would remain in place and, in any event, the defendant would be under an implied undertaking to only use any material, including the contents of the CD, for the purpose of the proceedings. The dissemination of the contents of the CD would be in breach of that undertaking. However, any discovery must be relevant, necessary, proportionate and have regard to the rights of third parties. It has not been alleged that the entire contents of the CD were disclosed by the defendant and the contents which are not alleged to have been disclosed seem to me to not be relevant or necessary or proportionate. Furthermore, it seems to me to be grossly disproportionate and in disregard of the rights of third parties whose information is on the CD and whose information is not alleged to have been disclosed by the defendant.

 

136.       For those reasons I will not order discovery of the entire CD.

 

137.       However, it does seem to me that the defendant must be entitled to discovery of the information which the plaintiffs are aware was disclosed. The core of the plaintiffs’ case is that the defendant disclosed certain information. The defendant makes some admissions in her Defence and Counterclaim but she also denies some of the alleged disclosures. She must be entitled to discovery of the information which it will be alleged she disclosed in order to meet the case to be made against her. It seems to me that these documents are relevant and necessary to the dispute between the parties, particularly where reference is made to the documents in the Re-Amended Statement of Claim.

 

138.       I appreciate that the plaintiffs make the point that the defendant is familiar with the contents of the CD and “the parts of the Confidential Information that appeared on social media and were received from anonymous sources prior to the making of the 4 December 2015 order (Gilligan J).” However, I do not accept that the defendant’s familiarity with some or all of the information which is alleged to have been disclosed obviates the necessity for this material to be discovered.

 

139.       I also appreciate that it may be the plaintiffs’ case that the defendant disclosed more information than they are aware of and that they can not discover “disclosed material” that they are not aware was disclosed. It seems to me that an order directing discovery of documents/information which the plaintiffs are aware was disclosed does not preclude them from making that case.

 

140.       Finally, I appreciate that even discovery of this material may involve disclosure of third- party information. This can be mitigated by permitting redaction of any information which would tend to identify the individual.

 

141.       I will therefore direct that the plaintiffs make discovery of any documents containing information which the plaintiffs are aware was disclosed and which it will be alleged was disclosed by the defendant, subject to appropriate redaction to maintain the confidentiality of the identity of the party/parties to whom such information relates.

 

 

 

2.    The Defendant’s ‘data access request’. [Emphasis in the original]

 

142.       This is not relevant to any dispute in the pleadings. The only relevance of the ‘data access request’ is that it led to the delivery of the CD containing information other than merely the defendant’s own data/information to the defendant.

 

143.       More particularly, the reason given by the defendant for seeking this category is that it affects the defence because the plaintiffs claim that the request was issued to them and the defendant denies this and therefore it “goes to the heart of the defence that the Plaintiffs locus standi to respond and issue the defendant’s personal data is in question…”. I understand this to be a reference to the point made in relation to paragraph 2 of the Notice for Further and Better Particulars that the request was in fact made to Stephen Tennant. This is not an issue raised in the pleadings. There is no denial that a data access request was made to Grant Thornton. Indeed, it is admitted in paragraph 4 of the Amended Defence and Counterclaim that the plaintiff responded, “to the Defendant’s data access request” and as discussed above, the defendant’s Counterclaim is based on a data access request having been made to the plaintiffs.

 

 

3.    Communication with the Office of the Data Commissioner in relation to the Defendant’s data access request. [Emphasis in the original]

 

144.       This category is sought in order for the defendant to establish that the plaintiffs are wrong that they were issued a data access request by the defendant and that they were only aware of this data request on the 14^th January 2015. I have dealt with the first of these reasons in the previous category. The second is not necessary in circumstances where the plaintiffs admit that they failed to respond to the defendant’s access request within the time limits contained in section 4 of the Data Protection Acts.

 

 

4.    Discovery and disclosure of any and all reports required by or issued to the Office of the Data Protection Commissioner reporting an incident where large amount of personal data was exposed to the defendant.

 

145.       This, and the reasons given for seeking discovery, reflect paragraphs 25 and 26 of the Notice for Further and Better Particulars. The defendant stated that discovery of this category was sought “to establish that the Plaintiffs genuine pursuit of legal orders for personal data which comprises the CD (subject matter of these proceedings) and as reported to the Data Protection Office in November 2015. That office requires a report of the breach details. To establish that the Data Commission informed the Plaintiffs they had no statutory standing to enforce Section 2 & 22 of the Data Acts for personal data loss or misuse and that the Defendant had no legal obligation to data privacy law or personal data disclosed. This goes to the heart of the defence that the Plaintiffs are not (and were not) entitled to pursue an interim order or permanent legal order for personal data property of private individuals and to establish if the Plaintiffs (outside of their legal representatives) are aware and/or informed by the Data Commissioner that they had no such standing in this regard and were required to file a legal complaint with the office for misuse of personal data.”

 

146.       The plaintiffs are not maintaining a claim in respect of “personal data” under the Data Protection Acts. The Data Commissioner’s views can not be determinative of the plaintiffs’ claim which is now brought solely under the common law breach of confidence and breach of duty. Thus, the Commissioner’s views can not be determinative, or indeed, probative of the issue in the case.

 

 

 

5.    Discovery and disclosure of proof or documents to affected Data Controllers, by the Plaintiffs Professional Standards and/or Risk Management informing affected parties of the data breach. Including a copy of the website notification that was allegedly published by the Plaintiff notifying of a personal data disclosure.

 

6.    Discovery and disclosure of the website notification posted by the Plaintiffs on their website regarding the data breach affecting private individuals.

 

7.    Discovery and disclosure of notification and Report to other organisations (data controllers) notifying of risk to their client’s information permitting data controllers to take appropriate measures to protect and notify data subjects to assist in protecting legal rights.

 

147.       It is convenient and appropriate to deal with these three categories together as there is considerable overlap in the reasons given for requiring each category.

 

148.       It is asserted that they go to the heart of the defence that the plaintiff’s pursuit of the defendant and their pursuit of High Court Orders are for ulterior motives which are set out in the reasons for each category. In fact, the defendant has not pleaded in the Defence and Counterclaim any defence that these proceedings are maintained for ulterior reasons. It may be the case that this was raised in some of the affidavits that were delivered earlier in the proceedings but (a) the Court, on the hearing of this motion was not provided with any such affidavits and (b) the relevance and necessity of discovery is to be determined by reference to the pleadings, which set the parameters of the case. This is all the more significant where the High Court and the Court of Appeal both had to consider the parameters of the defendant’s case.

 

149.       In those circumstances these categories of discovery are not relevant to a dispute in the pleadings.

 

 

8.    Disclosure and declaration of the Plaintiffs inter party agreement with Danske Bank for the direct provision of personal data, which they will no doubt rely on for custody and control of the Defendant’s personal data and the right to respond to the Defendant data access request. The Defendant is entitled to establish that the Plaintiffs have no standing over the defendant’s personal data and/or the personal data unlawfully disclosed by the Plaintiffs in 2015.

 

150.       This is not relevant to any dispute raised in the pleadings. The defendant asserts that this category is relevant because the “Plaintiffs claim they are entitled to the defendants (and third parties) personal information, which the defendant claims they have no contractual or statutory basis for this alleged interest”. The terms of this category only relate to the defendant’s own “personal data” save for the reference in the final few words to “personal data”. It is not in fact claimed in the Defence and Counterclaim that the plaintiffs have no contractual or statutory basis for its interest in the defendant’s data. Thus, this category can not be relevant.

 

 

9.    Disclosure of the email stream dated October 13^th, 2015 where the Plaintiffs response is …”as I understand it the issue of Ms Scanlan receiving third party documents have nothing to do with her there is nothing to say to Ms Scanlan as she has received her records…” And any other documents of this nature, which establish the Plaintiffs true reaction and activity around this data disclosure.

 

151.       Firstly, the second part of this is not a proper category of discovery and would be impossible to comply with and impossible to enforce.

 

152.       The reasons given for this category may be summarised as follows: that the plaintiffs claim to have been compelled to go to the High Court but that the “defendant claims that the Plaintiffs were in fact, unconcerned as to the disclosure and sought to avoid all interaction with the defendant notwithstanding their claim of confidence with the Defendant.”

 

153.       While this is not pleaded in express terms in the Defence and Counterclaim, the plea in the Re-Amended Statement of Claim that the plaintiffs were compelled to bring these proceedings and to seek injunctive relief (para. 17) is denied. It does seem to me, therefore, that discovery of an internal document which may illustrate a different attitude within the plaintiffs is relevant to this dispute. It is also necessary because it is a document which is internal to the plaintiffs. I am also satisfied that it is proportionate in that it is limited to one email chain on one day. Of course, I note the point made in the plaintiffs’ response to the letter seeking voluntary discovery that this quote is taken out of context and I express no view whatsoever about whether or not this quote or the email chain displays a different attitude on the part of the plaintiffs.

 

154.       I will therefore direct that discovery be made of “the email stream dated the 13^th October 2015 culminating in an email in which it is stated that as I understand it the issue of Ms Scanlan receiving third party documents has nothing to do with her there is nothing to say to Ms Scanlan as she has received her records…”

 

 

 

10.  Discovery and disclosure of any proof or documents regarding the Defendant’s presumed and/or required understanding, knowledge and/or legal obligations (or otherwise) for the disclosed data.

 

155.       Discovery in these terms is not necessary. It is clear from the Re-Amended Statement of Claim that the claim that the defendant knew or ought to have known that the Confidential Information was not the defendant’s personal data, that its release to her was unintended, that it was confidential information belonging to Grant Thornton which had been released to her in error, and that she had no entitlement to receive, retain, or publish it is based on the nature of the information. It will be a matter for the plaintiffs to establish each of these elements.

 

156.        It does seem to me that correspondence which the plaintiff sent to the defendant after the CD was provided to her, calling on her to give undertakings, is relevant to whether the defendant knew or ought to have known these matters but in circumstances where this was correspondence to the defendant discovery of same is not strictly necessary. However, it seems to me, particularly where the defendant is a litigant in person, there should be no scope for confusion as to what correspondence was exchanged between the parties in this regard.

 

157.       I will therefore direct that discovery be made of all correspondence between the plaintiff (or solicitors acting on their behalf) and the defendant between the 3^rd October 2015 and the 4^th December 2015.

 

 

 

11.  Discovery and disclosure regarding the Plaintiffs legal ownership and authority for and over the ‘confidential information’, comprising primarily of personal data property within the meaning of the Data Protection Acts 1988 & 2003 and reported as a data breach to the office of the Data Commissioner 24^th November 2015.

 

158.       The reason that is given is that the category “goes to the heart of a defence to breach of confidence and the Plaintiffs claim that the defendant understood their obligations in data protection law and common law legal obligation for confidential data in this regard.”

 

159.       There is no basis in the reason given for ordering discovery of this category. It is impossible to see how the discovery sought could be relevant to how the defendant understood her obligations in respect of confidential data.

 

160.       I have considered whether there is any other basis upon which the category could be discoverable. It clearly could not be discoverable on the grounds of any claim under the Data Protection Acts as no such claim is maintained by the plaintiffs.

 

161.       The category is focused on the “Plaintiffs legal ownership and authority for and over the information”. However, no issue or dispute is raised by way of denial or any other plea in the Defence and Counterclaim about the plaintiffs’ “legal ownership and authority” for and over the information. It is the case that the defendant denies a breach of confidence but she does not do so on any basis relating to the plaintiffs ownership of or authority over the information or on any basis relating to whether the plaintiff had any duty of confidentiality in respect of the information.

 

162.       It therefore does not seem to me to be discoverable on the basis of the pleadings.

 

 

12.  Discovery and disclosure of any proof or documents regarding the nature of the defendant’s threat and/or offences to personal data claimed by the Plaintiffs.

 

163.       The reason given for seeking this category of documents is that it is “not adequately pleaded regarding the Plaintiffs continued pursuit of the interim order over personal data. The defendant requires proof of threat to personal data for a continue claim for permanent orders for personal data. Note: The legal basis for personal data pursuit was removed by the Court of Appeal.”

 

164.       There are two limbs to this category: threats to personal data and offences to personal data. The second can only arise under the Data Protection Acts. The plaintiffs have made it clear that they are not pursuing any relief under the Acts and therefore discovery of this category under this limb does not arise.

 

165.       The request for discovery of the first limb reflects paragraph 30 of the Notice for Further and Better Particulars. The test for an order to compel particulars and for and order for discovery are, of course, different. However, it seems to me that similar reasoning applies in relation to this category of discovery. It is clear that the plaintiffs’ case is based on them having sought undertakings in respect of the Confidential Information and the defendant having offered an undertaking over part only of that information. While I have not seen the correspondence, I understand that this was the subject of correspondence between the papers. To the extent that the plaintiffs’ claim is based on them having sought an undertaking and the plaintiff having refused to give one the correspondence in that regard is relevant. I have already indicated that I will be directing discovery under category 10 of all correspondence between the plaintiffs (or solicitors acting on their behalf) and the defendant between the 3^rd October 2015 and the 4^th December 2015 and it seems to me that this is an appropriate and proportionate discovery in respect of this category also.

 

 

13.  Discovery and disclosure of any proof or documents regarding the legal basis and/or Defendant’s continued threat to company data, supporting the continued pursuit of a permanent injunctive order, against the backdrop of the Defendant’s offer of a permanent legal undertaking over disclosed company data.

 

166.       The reason that is given is that this is “also not adequately pleaded regarding the Plaintiffs continued pursuit of the interim order over company data. The defendant requires proof that the Plaintiffs are compelled to continue pursuit of orders over company data, which was in any case offered by the Defendant in 2016. The Defendant requires proof of threat to disseminate company data.”

 

167.       This is not a properly formulated category of discovery and the reasons advanced are not appropriate reasons. By seeking “proof” of the claims of the plaintiff, the defendant is in effect seeking to have the matter tried in the course of discovery. That is not the purpose of discovery.

 

168.       It also seems to me that the category is misconceived in the context of the pleadings and the relief that is sought. The plaintiffs do not seek a separate undertaking/injunction in respect of “company data”. They seek an undertaking/injunction in respect of all the Confidential Information and the defendant is not prepared to give an undertaking in those terms so it is in those circumstances that the plaintiffs are maintaining their claim for an injunction over all the information (including the “company data”).

 

 

 

14.  Discovery and disclosure of the Plaintiffs ownership and/or consent from affected data subjects to claim a permanent order for their personal data property for a data breach reported to the Office of the Data Commissioner 24^th November 2015. [Emphasis in the original]

 

169.       It is necessary to set out the reasons given by the defendant for seeking this category of documents:

 

“The Plaintiffs continue to claim legal orders for personal data of third parties to legitimise the pursuit of a trial. However, there is no proof provided regarding the Plaintiffs entitlement to pursue personal data offence and claim legal remedy for personal data violation. The Plaintiffs fail or refuse to identify if they continue to pursue legal orders for personal data pursuant to GDPR (Data Protection Act 2018) or at all or to establish what basis the owner of this personal property consented to this pursuit. The Plaintiffs only confirm that they no longer pursue the former Data Acts and/or damages pursuant to Section 7 of those Acts.” [Emphasis in the original]

 

170.       The entire basis for seeking this category of discovery, as set out in the reasons, is misconceived.

 

171.       The category is sought on the basis of the Data Protection Acts and no claim is being maintained by the plaintiffs’ on foot of these Acts.

 

172.       I dealt with the defendant’s complaint that the plaintiffs have not identified whether they are seeking orders under the Data Protection Act 2018 above. The plaintiffs have confirmed that they are not seeking any relief under the Data Protections Acts. More fundamentally, no claim for relief pursuant to or on foot of the Data Protection Act 2018 is included in the pleadings and therefore, on the current state of the pleadings they are not seeking and are not entitled to seek relief on that basis.

 

173.       The discovery is also sought on the basis that there is no proof of the plaintiffs’ entitlement to pursue personal data offences or to claim legal remedy for personal data violation. This is clearly based on the Data Protection Acts and these are not being relied upon by the plaintiffs. A need for the category, on the basis of the reasons advanced, simply does not arise.

 

174.       Furthermore, it must be noted that the Defence and Counterclaim does not put the plaintiffs’ entitlement to maintain the proceedings and seek the relief (whether under the Data Protection Acts or otherwise) in dispute either on the basis that they do not own the information or do not have the consent of the persons to whom the information relates to maintain the proceedings. Thus, the category is simply not directed towards an issue disclosed in the pleadings. As discussed above in a different context, it is clear from the correspondence, the affidavit grounding this motion and the motion in relation to particulars, and the submissions, that the defendant does take issue with the plaintiffs entitlement to seek relief in respect of the information relating to third parties but that is not an issue which is pleaded in the Defence and Counterclaim. The parameters of the proceedings are defined by the pleadings and the relevance and necessity of discovery have to be determined by reference to those pleadings.

 

 

 

15.  Discovery and disclosure of any proof or documents of the personal data breach identified in paragraph 13 of the Statement of Claim and proof of the nature of the Plaintiffs confidential information is a personal data breach or breach of confidence. The Defendant has not been provided proof of same. [Emphasis in the original]

 

175.       There is no obligation on the part of the plaintiffs to provide proof of their claim.

 

 

176.       In any event, it seems to me that to the extent that this category is relevant or necessary is it is addressed by the discovery which I have indicated I will make in respect of category 1, subject to hearing from the parties as to the precise terms of the order. The nature of the information and whether or not the disclosure of this information amounts to a personal data breach (if that arose on the pleadings) or a breach of confidence is a matter for submissions.

 

 

 

16.  Discovery and disclosure of the Defendant’s legal wrongdoing with third party property and privacy and the impact (legal or otherwise) on the plaintiffs in relation to this wrongdoing.

 

177.       This is not a properly formulated category of discovery. It would be impossible to provide discovery of a “legal wrongdoing”. I have taken the category to mean “documents relating to or identifying legal wrongdoing…”.

 

178.       It seems to me that this is also addressed by the discovery that I have indicated that I will order in respect of category 1. That requires discovery to be made of the information which the plaintiff is aware of that it alleges was disclosed by the defendant. It will be a matter for the trial judge to determine whether the defendant did in fact disclose any of the material and, if so, whether that amounts to “legal wrongdoing.”

 

 

17.  Discovery and disclosure regarding any lawful offence committed by the Defendant in allegedly disclosing to Mr. Kevin Brophy that his persona data was subject of a data breach.

 

179.       My comments at paragraph 178 in respect of category 16 apply here also.

 

 

18.  Discovery and disclosure of any proof or documents regarding the “received correspondence” from third parties “who have in their possession” as claimed under the Plaintiffs Particulars in the Statement of Claim, including the following identifying the defendant as the party involved in these alleged activities.

(i)            That the email on 26^th November 2015 is the Defendants and or formed part of the data disclosure of 2015? [Grant Thornton received an email on 26 November 2015 from the “The Research Router”, with an email address of researchroue@yahoo.com and email name of “Due Diligence” regarding a document comprising of Confidential Information]

(ii)           That the letter dated 15^th April 2016 is the Defendants and or formed part of the data disclosure of 2015? [A letter dated 15 April 2016 was delivered to Grant Thornton Cork by “A concerned member of the public” enclosing a memory stick including Confidential Information];

(iii)         That the letters of 10 March and 31^st March 2016 is the Defendants and/or formed part of the data disclosure of 2015? [The Plaintiffs were provided with anonymous letters dated 10 March 2016 and 31 March 2016 sent to Baker Tilly Ryan and Byrne Wallace, which included the Confidential Information];

(iv)         That the Facebook profile or comments are the Defendants and formed part of the data disclosure of 2015? [On or around 25 and 26 November 2015, a Facebook profile under the name Due Diligence posted comments that included an annotated screen shot of part of Confidential Information].

(v)          That the Twitter profile is the defendants and formed part of the data disclosure of 2015? [On or around 25 and 26 November 2015, a twitter account under the name Due Diligence tweeted the same annotated screen shot tagging the journal.ie and the Grant Thornton Ireland twitter accounts].

(vi)         Please identify the Defendant’s legal offences in showing Mr. Scriven the disclosed data? Please particularise any subsequent threat to the Plaintiffs following Mr. Scriven’s undertaking that he would not disclose data personal or otherwise that compelled the Plaintiffs to pursue High Court legal orders

(vii)        Please identify the data, personal or company disclosed to Mr. Keogh and the consequences of same? [Emphasis in the original]

180.       This category is described as being required on the basis that the “disclosed data was not only released to the defendant. It was unlawfully disclosed to other parties. The defendant is entitled to establish if the Plaintiffs can substantiate their claims with proof that the defendant is responsible for any alleged unlawful disclosure of personal and company data. Please identify others in receipt of the disclosed data and the legal measures taken regarding same.”

 

181.       It seems to me that the correspondence received from third parties who have in their possession documents comprising part of the Confidential Information and the email of the 26^th November 2015, the letter dated the 15^th April 2016, the letters of the 10^th March and 31^st March 2016 to Baker Tilly Ryan and Byrne Wallace respectively, the posts on Facebook of the 25^th and 26^th November 2015, and the tweets of the 25^th and 26^th November 2015 are discoverable. I note that the plaintiffs state that these have already been provided to the defendant and can be provided again. I believe it is appropriate that this should be done by way of discovery.

 

182.       However, interrogation of the evidence is not the purpose of discovery. Sub-paragraphs (i) - (vii) essentially seek to interrogate the evidence by calling for confirmations or admissions of certain things and are not appropriate matters for discovery.

 

 

19.  Discovery and disclosure of proof of documents disclosed by the defendant claimed by the Statement of Claim in the ‘Particulars’. [Emphasis in the original]

 

183.       It is unclear what this category is seeking and on that basis alone could not be ordered by the Court. There also does not appear to be any link between the category and the reasons given for seeking discovery. Those reasons seem to suggest that someone else may have disclosed the material but the discovery that is sought is discovery of proof of the documents disclosed by the defendant.

 

184.       To the extent that what is sought is the information which it is alleged by the plaintiffs was disclosed by the defendant, this is addressed by the order for which I will make in respect of category 1.

 

 

20.  Discovery and disclosure of the communications between the Data Commissioner’s Office and the Plaintiffs about the Defendant regarding the data access, data breach, and the Defendant’s alleged offences against personal data. [Emphasis in the original]

 

185.       The reasons given for requiring discovery of this category are:

 

“This goes to the heart of the defence in that the Defendant asserts that they have no legal obligations, duty of care or statutory duty to personal data as verified by the data commissioner in April 2016. The Defendant is entitled to the Commissioner’s response to the Plaintiffs regarding the Plaintiffs assertions on 24^th November 2015 that the Defendant had legal obligations to personal data pursuant to Section 2 & 22 of the Data Protection Acts 1988 & 2003 and that the Plaintiffs were entitled to enforce the said Acts against the defendant regarding same. The Defendant is entitled to prove that they should not have been in these legal proceedings at all regarding any of this disclosed data”

 

186.       I am satisfied that this category is not relevant to any dispute disclosed by the pleadings. It is entirely focused on the Data Protection Acts, whether the defendant has any obligation under those Acts and whether the plaintiffs have any entitlement or standing to take steps in respect of those Acts. The plaintiffs are not maintaining any action under or on foot of the Data Protection Acts and in those circumstances the category is not relevant to any dispute disclosed in the proceedings.

 

 

 

21.  Discovery and disclosure and/or agreement, oral or otherwise which placed the Defendant in a position of confidence (for breach of confidence) with the Plaintiffs regarding personal or company data or any data at all.

a.    The date of contract/agreement;

b.    The parties who concluded the agreement/contract;

c.     Whether the contract/agreement was concluded orally or in writing;

d.    That the Defendants personal data (or others as disclosed) was company property and thus company confidential information

e.    If concluded orally, the time, date and venue at which the contract/agreement was made;

f.     If concluded in writing, identify the written contract/agreement and furnish a copy to include terms and conditions particularly elating to the Defendant’s expected and required confidences.

g.    A relationship identifying the Plaintiff took the Defendant into their confidence regarding information in their custody and/or the confidential information (“the CD”) in question

h.    Notification to the Defendant regarding any information disclosed or in their custody or the consequences, sanctions and penalty regarding same.

 

187.       This obviously reflects paragraph 27 of the Notice for Further and Better Particulars. It seems to me there are two specific issues with the category. Firstly, paragraphs (a)-(e), and (g) are more in the nature of a request for particulars rather than a request for discovery and I have previously addressed them above. Secondly, the opening paragraph and sub-paragraph (f) seeks discovery of a contract which has not been pleaded. It seems to me, therefore, that it is not an appropriate matter for discovery.

 

188.       Sub-paragraph (h) does seem to me to be discoverable in principle as to goes to the issue of what contacts there were between the plaintiffs and the defendant in relation to the information. This is addressed by the order which I propose to make in respect of category 10.

 

 

 

22.  Discovery and disclosure of proof or documents regarding the Defendant’s refusal to return the CD to the Plaintiffs.

 

189.       The plaintiffs have refused to make discovery of this category on the basis that it, in effect, seeks further particulars of the plaintiffs’ claim and that the defendant’s refusal to return the CD is apparent from the inter partes correspondence exchanged between the plaintiffs and the defendants which are, by their nature, available to the Defendant.

 

190.       I do not accept that what is sought by this category is limited to further particulars of the plaintiffs’ claim.

 

191.       It does seem to me that documents relating to the defendant’s refusal are discoverable in principle but the only documents that could be relevant or necessary are demands for their return and refusal to do so. This is addressed in the terms of the discovery which I propose to order in respect category 10.

 

23.  Discovery and disclosure for the claim of loss and damage at paragraph 23 of the Statement of Claim. [Emphasis in original]

 

192.       There is no basis for ordering discovery in circumstances where no claim for damages is being maintained by the plaintiffs.

 

 

 

24.  Discovery and disclosure of correspondence and emails between Carla Costigan and Deirdre Bonus regarding the defendant’s data access request follow up with the Data Protection Office.

 

193.       The reasons advanced by the defendant for requiring this category are:

 

” To establish the time-line of the data access request, the subsequent requests by the Data Officer and the eventual delivery of personal data September 2015 substantiating the Plaintiffs failure to meet obligations in data law, which resulted in the Defendant’s counterclaim for Section 7 damages for breach of fundamental rights.” [Emphasis in original]

 

194.       In her Counterclaim, the defendant claims damages pursuant to section 7 “for the Plaintiffs failure to provide the Defendant’s data access request within the Statutory time permitted or within any reasonable time at all, in violation of and contrary to Section 4 of the Acts and consequently in violation of the Defendant’s fundamental rights as enshrined in Article 8, which concealed material facts from the Defendant and had a consequential detrimental effect on the Defendant’s litigation.”

 

195.       The plaintiffs in their Amended Reply and Defence to Counterclaim admit to failing to respond to the Defendant’s access request within the time limits contained in section 4 of the Data Protection Acts.

 

196.       Thus, while the plaintiffs deny that the defendant is entitled to any damages or that she suffered the alleged or any loss or damage, there is no dispute between the parties that the plaintiff failed to provide the data access request within the statutory time period.

 

197.       The sole reason advanced for this category of discovery is to substantiate “the Plaintiffs failure to meet obligations in data law”. As that failure is already admitted this category of discovery is not relevant or necessary.

 

198.       I will therefore make an Order for discovery in the following terms:

 

1.         Any documents containing information which the plaintiffs are aware was disclosed and which it will be alleged was disclosed by the defendant, subject to appropriate redaction to maintain the confidentiality of the identity of the party/parties to whom such information relates

 

2.         The email stream dated the 13^th October culminating in an email in which it is stated that “…the issue of Ms. Scanlan receiving third party documents has nothing to do with her there is nothing to say to Ms. Scanlan as she has received her records.”

 

3.         Direct that discovery be made of all correspondence between the plaintiff (or solicitors acting on their behalf) and the defendant between the 3^rd October 2015 and the 4^th December 2015.

 

4.         The correspondence received from third parties who claim to have or have in their possession documents comprising part of the Confidential Information, the email of the 26^th November 2015, the letter dated the 15^th April 2016, the letters of the 10^th March and 31^st March 2016 to Baker Tilly Ryan and Byrne Wallace respectively, the posts on Facebook of the 25^th and 26^th November 2015, and the tweets of the 25^th and 26^th November 2015.

 

199.     I will hear from the parties in respect of the time period required for the delivery of the further and better particulars specified above and for the making of discovery.

Result:     Order for discovery made