High Court of Justice in Northern Ireland King's Bench Division Decisions

Neutral Citation No: [2024] NIKB 57     Judgment: approved by the court for handing down (subject to editorial corrections)*

Ref:                McB12566   ICOS No:           23/108363   Delivered:     28/06/2024

 

 

IN THE HIGH COURT OF JUSTICE IN NORTHERN IRELAND

 

KING’S BENCH DIVISION

(COMMERCIAL HUB)

__________

 

BETWEEN:

FIBRUS NETWORKS LTD

Plaintiff;

and

 

GARETH LECKEY

and

R&A CONSULTING AND BROKERAGE SERVICES LTD

 

Defendants.

__________

 

Mr Coghlin KC and Ms Rowan (instructed by Carson & McDowell LLP) for the Plaintiff

The first Defendant acted as litigant in person and on behalf of the second named defendant

__________

 

McBRIDE J

 

Applications

 

[1]       There are two inter-related applications before the court, namely:

 

(a)       An application by the plaintiff for summary judgment seeking a permanent injunction against both defendants requiring them to deliver up information and ordering them to restrain them using information obtained by them from the plaintiff, in breach of the equitable doctrine of confidence and in breach of the plaintiff’s database rights.

 

(b)       An application by the defendants seeking the discharge of the interim injunction granted to the plaintiff on 22 December 2023. 

 

 

Representation

 

[2]       The plaintiff was represented by Mr Coghlin KC and Ms Rowan of counsel.  The defendant appeared as a litigant in person.

 

Evidence

 

[3]       The court had the benefit of the following affidavit evidence:

 

(a)       Affidavit filed by Mr McGinley, general counsel in the plaintiff company, dated 27 March 2024.

 

(b)       Replying affidavit by Mr Leckey dated 10 May 2024.

 

(c)        Rejoinder affidavit of Mr McGinley dated 24 May 2024. 

 

[4]       In addition the court had before it the affidavits filed in respect of the application for the ex-parte injunction and the inter-partes interim injunction namely:

 

(a)       Affidavit filed by Mr McGinley sworn on 21 December 2023.

 

(b)       Second affidavit of Mr McGinley sworn on 21 December 2023.

 

(c)        “Affidavit” filed by Mr Leckey in accordance with the requirements of the injunction dated 21 December 2023.  The affidavit was unsigned and erroneously dated 2 May 2023.

 

(d)       Replying affidavit of Mr McGinley dated 24 May 2024.

 

[5]       Mr Leckey additionally filed several documents which he entitled “affidavits.”  Upon inspection these documents consist of legal submissions rather than sworn factual evidence. 

 

Background

 

[6]       From the affidavits filed the following background facts appear not to be in dispute:

 

(a)       The plaintiff is a limited liability company which carries on business as a broadband provider.  Its registered office is in Belfast.

 

(b)       The plaintiff obtained email addresses from its customers and with the customers’ consent the plaintiff was permitted to use these, inter alia, to contact their customers.  The emails were stored by the plaintiff in a database known as Customer Relations Management System (“CRM”).

 

(c)        From in or around 11 December 2023 the first-named defendant, Mr Leckey was engaged as an Installations Coordinator in the plaintiff’s Installations Department, in his capacity as an agency worker supplied by Vanrath, a recruitment company. 

 

(d)       The second defendant is a single member company known as R&A Consulting and Brokerage Services Ltd.  It runs an online competition website.  The second defendant is owned and controlled by Mr Leckey.

 

(e)       Mr Leckey’s role in the plaintiff company required him to have access to its customers’ details on the CRM in order to assist with customer broadband installations.

 

(f)        On 16 December 2023 a customer alerted the plaintiff to the fact that he had received a spam email from an individual. 

 

(g)       Upon investigation the plaintiff was able to trace and match the breach to Mr Leckey.  The investigation indicated that on 13 December 2023 at 20:20 Mr Leckey copied names and email addresses from the CRM unto an Excel file before transferring it to a rich text document and “bluetoothing” it to his phone.  He then uploaded the email addresses to his Wix website platform and used the emails to create a distribution list for use by the second defendant who used it to send out promotional emails for a company competition.

 

(h)       The plaintiff informed the Information Commissioner’s Office and the PSNI of the breach.

 

(i)        On 18 December 2023 the plaintiff and the PSNI sought, without success to contact Mr Leckey by telephone.

 

(j)        Mr Leckey attended the plaintiff’s offices on the following Monday.  When he tried to log into his computer, he was denied access.  He then left.  He later texted Vanrath stating the job was not for him.

 

(k)       On 21 December 2023 the plaintiff applied for injunctive relief on an ex-parte basis.

 

(l)        The court granted the relief sought and returned the case for an inter-partes application on 22 December 2023.

 

(m)      On 22 December 2023 the court received a second affidavit filed by Mr McGinley.  At paragraph 19 of this affidavit, he clarified that Mr Leckey was not in an employee of the plaintiff company but rather had a services agreement with Vanrath and his temporary worker status was engaged through Vanrath.

 

(n)       On 22 December 2023 the court granted an injunction which inter alia ordered that each of the defendants:

 

“shall not use, publish or communicate or disclose to any person any information in whatever form relating to the business, products, affairs and customers of the plaintiff for the time being confidential to the plaintiff including without limitation any of its suppliers, clients, customers including customer databases, customer addresses, customer names, customer email addresses and any data documents, data bases, customer details and/or customer names which are the property of the plaintiff.”

 

It further required the defendants to,

 

“deliver up to the plaintiff all of the plaintiff’s data and any documents which contain confidential information in respect of documents which existed only in computer readable form the defendant was required to cause this document to be copied onto an electronic storage medium in native format and given to the plaintiff’s solicitors within a period time. “

 

and required,

 

“The defendants to preserve and not to make use of and/or disclose and/or publish and/or copy and/or part with possession or control of any of the confidential information or data obtained.  It further required them not to destroy, delete, alter or tamper with or override or part with possession of any of the confidential information.”

 

(o)       On 12 January 2024 in compliance with this order the defendant delivered a pen drive to the plaintiff containing copy data which comprised 105,000 names and email addresses of the plaintiff’s customers and potential customers. 

 

(p)       On 2 May 2024 in compliance with the injunction dated 21 December 2023 Mr Leckey filed an affidavit in which he stated as follows:

 

“… The only data I hold related to Fibrus Networks Ltd are the email addresses of the potential and current customers which I had initially obtained for a free competition hosted by my business …

 

Circumstances of data download: 

 

The data was downloaded during my tenure as a temporary Installations Admin at Fibrus.  Without any malicious intent and unaware of the potential wrongdoing I copied the names and email addresses into an Excel file, later transferring it to a rich text document and bluetoothing it to my phone.  …

 

Distribution of data/confidential information: 

 

The email addresses were uploaded to my Wix website platform to send out promotional emails for the competition.  …

 

Details of data storage and disclosure: 

 

The data has been stored electronically on my personal phone and my Wix website platform.  There has been no disclosure of this data to any third party except for the use described in point 4. 

 

Usage of the data: 

 

The data was used solely for the purpose of inviting individuals to participate in a free competition.

 

The data is currently stored on my phone and on the Wix platform.  I have not deleted or destroyed it yet but plan to do so …”

 

(q)       Accordingly, Mr Leckey has admitted that he has downloaded data from CRM during his tenure as a temporary Installation Administrator at the plaintiff and copied the names and email addresses to an external platform, for the purpose of sending out promotional emails for a competition hosted by the second defendant.  He accepts that he continues to hold the data which comprises 105,000 customer and potential customer email addresses and names.

 

[7]       By statement of claim issued on 26 March 2024 the plaintiff seeks a permanent injunction.  Unlike the interim injunction application, the permanent injunction seeks additionally that the data held by the defendants and each of them is to be “deleted, erased and destroyed.”

 

The defendants’ “motion to dismiss”

 

[8]       The defendants seek the discharge of the interim injunction on the grounds that it is “unjustified and disproportionately detrimental to (the defendants) operations and reputation.”

 

Relevant legal principles regarding summary judgment

 

[9]       Order 14 rule 1 provides as follows:

 

“Where in an action to which this rule applies the statement of claim has been served on a defendant and that defendant has entered an appearance in the action, the plaintiff may, on the ground that that, defendant has no defence to a claim included in the writ, or to a particular part of such a claim, or has no defence to such a claim or part except as to the amount of any damages claimed, apply to the court for injunction against that defendant.”

 

[10]     Rule 3 further provides:

 

“Unless on the hearing of an application under rule 1 either the court dismisses the application or the defendant satisfies the court with the respect to the claim or the part of a claim, to which the application relates that there is an issue or question in dispute which ought to be tried where that there ought for some other reason to be a trial of that claim or part, the court may give such judgment for the plaintiff against that defendant on that claim or part as may be just having regard to the nature of the remedy or relief claimed.”

 

[11]     The applicable principles governing Order 14 applications have been set out in a number of cases including AIB Group (UK) plc v the Personal Representative of James Aiken Deceased, Andrew Jonathan Aiken and Mary Aiken [2012] NIQB 51 and Ulster Bank (Ireland) Ltd & Ors v Taggart [2012] NIQB 46.  I consider the applicable principles relevant in this case can be conveniently summarised as follows:

 

(i)                   Where a defendant shows that he has a fair case for defence or reasonable grounds for setting up a defence or even a fair probability he has a real or bona fide defence, or for some other reason there ought to be a trial, leave to defend ought to be given.

(ii)                  Summary judgment should not be granted where there is a serious conflict as to matters of fact.  In respect of matters of fact, the burden is on the defendant to establish that his evidence is reasonably capable of belief.  Mere assertions in affidavit are not sufficient.

 

(iii)          No matter how difficult a point of law is involved, once the court is satisfied that it is unarguable it should give final judgment.”

 

Submissions of the parties

 

[12]     The plaintiff submitted that its claim for summary judgment for a permanent injunction for breach of confidence and breach of database rights was unanswerable.  In response Mr Leckey submitted that the case was, “replete with significant factual disputes and legal complexities and therefore necessitated a full trial.” 

 

Principles of the law of confidence

 

[13]     The applicable test, in cases of classic commercial confidence was set out by Megarry J in Coco v A N Clark [1969] RPC 41.  He stated that a successful claim for breach of confidence required the following three elements to be established:

 

(a)       The information must be of a confidential nature.

 

(b)       The information must have been imparted in circumstances importing an obligation of confidence.

 

(c)        There must be an unauthorised use of the information to the detriment of the party communicating it.

 

[14]     In Coco it was common ground that there was no contractual relationship between the parties.  Nonetheless, Megarry J held that an obligation of confidence can arise in equity between parties even where there is no contractual obligation.

 

[15]     In Imerman v Tchenguis [2011] Fam 116 Lord Neuberger further accepted a long line of authority that equity prevails against third parties deriving benefit under a breach of confidence.  He quoted with approval the following dicta from Morison v Moat [1851] 9 Hare 241 where Turner VC stated:

 

“The defendant admits that the secret was communicated to him by Thomas Moat … It was clearly a breach of faith and of contract on the part of Thomas Moat to communicate the secret.  The defendant derives under that breach of faith and of contract, and I think he can gain no title by it … Equity prevails against parties deriving under the breach of contract or duty.  It might indeed be different, if the defendant was a purchaser for value of the secret without notice of any obligation affecting it; and the defendant’s case was attempted to be put upon this ground … but I do not think that this view of the case can avail him … so far as the secret is concerned, he is a mere volunteer deriving under a breach of trust or of contract.” 

 

[16]     Similarly in Duchess of Argyll v Duke of Argyll [1967] Ch 302 Ungoed-Thomas J held:

 

“An injunction may be granted to restrain the publication of confidential information not only by the person who was a party to the confidence but by other persons into whose possession that information has improperly come.”

 

[17]     In AG v Guardian Newspapers Ltd (No 2) [1990] 1 AC 109 Lord Goff appeared to extend the power to grant relief against third parties who received the confidential information innocently when he stated that confidence could be invoked “where an obviously confidential document is wafted by an electric fan out of a window … or … is dropped in a public place, and is then picked up by a passerby.”

 

Consideration

 

(i)        Was the information imparted to Mr Leckey and the second defendant of a confidential nature?

 

[18]     In Coco, Megarry J held that there can be no breach of confidence in revealing to others something which is already common knowledge.  He did accept however that something created from materials in the public domain which involved skill and ingenuity of the human brain could be of a confidential nature.  The plaintiff avers that the names and email addresses contained in the CRM were not publicly available and the list could not be collated from publicly available resources.  It averred that it had spent considerable time and energy in creating the list. It had actively obtained customers names and email addresses and compiled the list to assist in meeting customers’ need. The customers had provided the information on the basis it would only be used by the plaintiff for these limited purposes.  

 

[19]     Mr Leckey has not sought to assert that the information was available in the public domain. 

 

[20]     I am satisfied that the plaintiff’s list of names and email addresses contained in the CRM was of a confidential nature.  The fact that two customers complained that they had received spam emails confirms that these customers had not made their email addresses publicly available.  The fact one of the complaining customers was Mr McGinley does not undermine or make the plaintiff’s evidence in this regard unreliable or otherwise create a conflict of interest as asserted by Mr Leckey.  Further I am further satisfied that the creation of the list involved human skill and use of time and resources and for this reason the CRM is of a confidential nature.  Accordingly, on the basis the information was not in the public domain and on the basis the creation of the list involved human skill and ingenuity I am satisfied that the information was of a confidential nature.

 

(ii)       Was the information imparted in circumstances importing an obligation of confidence?

 

[21]     In determining whether the circumstances import an obligation of confidence, the court applies an objective test and asks whether “any reasonable man standing in the shoes of the recipient of the information would have realised that upon reasonable grounds the information was being given to him in confidence, then this should suffice to impose upon him the equitable obligation of confidence” (per Megarry J in Coco page 48) .

 

[22]     Megarry J in Coco at page 48 further suggests:  

 

“… Where information of commercial or industrial value is given on a business like basis and with some avowed common object in mind, such as a joint venture or the manufacture of articles by one party for the other, I would regard the recipient as carrying a heavy burden if he seeks to repel a contention that he was bound by an obligation of confidence.” 

 

[23]     I am satisfied that Mr Leckey gained access to the CRM in his capacity as an Installations Operator with the plaintiff and these circumstances imposed an obligation of confidence upon him.  The only basis upon which Mr Leckey seeks to repel this contention is that he was not an employee of the plaintiff company.  Mr Leckey submits that he was an agency worker and as such was not employed by the plaintiff.  Accordingly he submits that he owed no duty of confidence to the plaintiff. 

 

[24]     The plaintiff accepts that Mr Leckey was an agency worker and not an employee.  Nonetheless, I agree with Megarry J’s analysis of the law in Coco, which absent a contractual relationship a duty of confidence can arise in equity.  Accordingly, even though Mr Leckey owed no contractual duty of confidence to the plaintiff such a duty can arise in equity. 

 

[25]     Mr Leckey signed a worker’s agreement with his employer Vanrath.  This agreement contained the following definition of confidential information:

 

“Confidential information means any and all confidential, commercial, financial, marketing, technical or other information or data of whatever nature relating to the hirer or employment business or their business or affairs including but not limited to these terms, data, records, reports, agreements, software, programs, specifications, knowhow, trade secrets and other information concerning the assignment in any form or medium whether disclosed or granted access to whether in writing, orally or by any other means provided to the agency worker or any third party in relation to the assignment by the hirer or the employment business or by a third party on behalf of the hirer whether before or after the date of these terms together with any reproductions of such information in any form or medium or any parts of such information.”

 

[26]     “The hirer” was defined in the agreement as the plaintiff company.

 

[27]     When Mr Leckey signed the worker’s agreement, he understood the meaning of confidential information and in accordance with this definition would have understood and known that the information contained in the CRM was of a confidential nature.  The information contained in the CRM was given on a business‑like basis to enable Mr Leckey to carry out his job as an Installation Administrator.  In these circumstances he carries a heavy burden to repel the contention he is bound by an obligation of confidence.  I am satisfied that he has not repelled the contention and accordingly I find this second element of the doctrine of confidence is established.

 

(iii)     Was there an unauthorised use of the information to the plaintiff’s detriment?

 

[28]     Mr Leckey admits that he exported 105,000 email names and addresses to an external platform for his own use and use by the second defendant.  I am satisfied that Mr Leckey knew that such use was not permitted by the plaintiff.  Under Clause 11 of the workers’ agreement, he agreed as follows:

 

“In order to protect the confidentiality and trade secrets of any hirer … and without prejudice to every other duty to keep secret all information given to it or gained in confidence the agency worker agrees as follows:

 

11.11 Not at any time, whether during or after an assignment … to disclose to any person or to make use of any of the trade secrets or the confidential information of the hirer … with the exception of information already in the public domain.

 

11.12 To deliver up to the hirer … at the end of each agreement all documents and other materials belonging to the hirer which are in its possession including documents and other materials created by him/her during the course of the assignment.

 

11.13 Not at any time to make any copy, abstract, summary or precis of the whole or any part of any document or other material belonging to the hirer except when required to do so in the course of its duties under an assignment in which event any such item shall belong to the hirer …”

 

[29]     Although this was an agreement between Mr Leckey and Vanrath I am nonetheless satisfied as a result of signing this agreement that he knew his conduct in extracting information from the plaintiff’s CRM was unauthorised.

 

[30]     Mr Leckey contends that he extracted the information without malice and submits that no harm was caused to the plaintiff.  This is, he submitted, confirmed by the fact the Information Commissioner took no further action against the plaintiff company.

 

[31]     In Coco, Megarry J left open the question whether a plaintiff must prove detriment.  I am satisfied that this moot point is not engaged in the present case as I am satisfied the plaintiff did sustain harm arising from the defendant’s action.  The plaintiff had to deal with irate customers; had potential loss of reputation; needed to alert the Information Commissioner and the PSNI; had to expend time and energy investigating to establish the source of the breach and had to take steps to mitigate its losses.  The fact the Information Commissioner took no further action does not mean the plaintiff sustained no harm.  It is important to note that the legal test applied by the Information Commissioner and the test for breach of confidence are radically different. 

 

[32]     I am therefore satisfied that all three elements of the equitable doctrine of breach of confidence are established.

 

[33]     Mr Leckey submitted the court should nonetheless grant leave to defend on several other grounds.  He submitted that he should be entitled to seek discovery and in particular sight of the Information Commissioner’s report.  In the absence of this document, he stated that he could not receive a fair trial.  I do not accept this submission as I do not consider the Information Commissioner’s report would undermine any of the three elements of the plaintiff’s claim for breach of confidence and I am not satisfied that it would contain any information which would advance a defence for the defendant.  Accordingly, I am satisfied there are no factual issues which require a trial in this case.  I am also satisfied that the defendant has not made out any bona fide defence and I do not consider that there is any question of law or other serious issue which ought to be tried.  Accordingly, I consider the grounds for summary judgment are made out against the first defendant.  In respect of the second defendant the company obtained the information from the defendant and used it for its own purposes.  In accordance with the dicta set out in Morison and the Duchess of Argyll cases I am satisfied that the plaintiff is entitled to relief against the third party especially as the third party received the information as a volunteer and therefore has no possible defence.

 

Relief

 

[34]     In Imerman the court considered the appropriate relief to be granted where there was a breach of confidence.  Lord Neuberger stated at paragraph 72 as follows:

 

“If a defendant looks at a document to which he has no right of access and which contains information which is confidential to the claimant, it would be surprising if the claimant could not obtain an injunction to stop the defendant repeating his action, if he threatened to do so … An injunction to restrain passing on, or using, the information, which seemed to be self-evidently appropriate - always subject to any good reasons to the contrary on the facts of the case.  If the defendant has taken the documents, there can almost always be no question but that he must return them: they are the plaintiff’s property. If the defendant makes paper or electronic copies, the copies should be ordered to be returned or destroyed … A claim based on confidentiality is an equitable claim. Accordingly, the normal equitable rules apply. Thus, while one would normally expect a court to grant the types of relief we have been discussing, it would have a discretion whether to refuse some or all such relief on familiar equitable principles. … But, as we have noted, where the confidential information has been passed by the defendant to a third party, the claimant’s rights will prevail as against the third party, unless he was a bona fide purchaser of the information without notice of its confidential nature.”

 

[35]     The defendant resists the grant of an injunction on the basis that it is excessive and imposes significant financial and reputational harm upon him.  He seeks the discharge of the interim injunction on the same grounds.

 

[36]     The defendant has produced no evidence of harm flowing from the injunction and I am satisfied that there is no evidence of harm in this case.  The injunction merely restores the status quo so that the defendants are not advantaged by misuse of confidential information.  The injunction otherwise does not curtail the defendant or the second defendant in the pursuit of their original business. 

 

[37]     Injunctive relief is equitable in nature and Mr Leckey submitted that the plaintiff effectively misled the court when it granted interim relief as the plaintiff erroneously advised the court, he was an employee of the plaintiff.  I am satisfied the plaintiff did not deliberately mislead the court in this regard.  Further, Mr McGinley in his second affidavit clarified that the defendant was not an employee but rather an agency worker.  Accordingly, before the court granted the injunction on 22 December 2023 it was aware of Mr Leckey’s true employment status. 

 

[38]     For the reasons I have already outlined the court was entitled to grant interim injunctive relief on the basis not of contract but in equity.

 

[39]     I am satisfied that permanent injunctive relief is a just and proportionate remedy in this case.  The defendant has retained the information and there is a real risk that he would use this information to the detriment of the plaintiff and accordingly the only appropriate way to restrain the use is by means of an injunction.

 

[40]     The plaintiff also sought relief on the basis that the defendant’s actions breached its database rights.

 

[41]     The Copyright Designs and Patents Act 1988 (“the 1988 Act”) and the Copyright and Rights in Databases Regulations 1997 provide a right to relief by way of damages and injunctions for infringement of database rights.

 

[42]     Regulation 3A(i) of the 1988 Act gives a wide definition to the term databases and covers lists of customers whether held electronically or on paper.  Further by regulation 3 a database right subsists in a database “if there has been a substantial investment in obtaining, verifying or presenting the contents of the database.”  By regulation 12 investment includes “any investment, whether of financial, human or technical resources.”  Substantial means “substantial in terms of quantity or quality or a combination of both.”  Regulation 16 provides:  

 

“A person infringes database right in a database if, without the consent of the owner of the right, he extracts or reutilises all or a substantial part of the contents of the database.”

 

[43]     I am satisfied that the plaintiff’s list of names and email addresses was a database, and that the plaintiff had a database right in the CRM as substantial financial human and technical resource was invested in creating it.  For the reasons already outlined I am satisfied the defendant infringed this database right when he extracted part of the information contained within it without the plaintiff’s consent.  Accordingly, I am satisfied the defendant has no answer to a claim for breach of the plaintiff's database rights and in accordance with the 1988 Act the plaintiff is entitled in these circumstances to summary judgment for injunctive relief, a remedy available under the 1988 Act.

 

Conclusion

 

[44]     I am satisfied that the defendants have no bona fide defence to the plaintiff’s claim for the reasons set out and, accordingly, I grant summary judgment for a permanent injunction in the terms set out in the attached order.

 

[45]     For the reasons already outlined I consider that there is no merit in the defendant’s motion to discharge the injunction and, accordingly, this claim is dismissed.

 

[46]     The defendants shall pay the plaintiff’s costs such costs to be taxed in default of agreement.