Courts support disclosure of data held by past employees

England and Wales

Two recent court decisions – one under the ongoing Disclosure Pilot Scheme and the other under the pre-existing Civil Procedure Rules (CPR) – demonstrate the importance the courts place upon disclosure of relevant material held by past employees of one of the parties.

Disclosure under CPR 31

Background

In Phones 4U Ltd v EE Ltd & Others[2021] EWCA (Civ) 116, the underlying allegation was that the defendants had entered into anti-competitive arrangements. Certain former senior officers of the defendants were believed to have used their personal devices to send and receive work-related emails and direct messages that might relate to these arrangements.

At first instance, the judge ordered the defendants to write to these ex-employees to request that they hand over the devices to an IT consultant, who would search the devices for work-related communications. These would be passed on to the defendants’ solicitors. The consultants would then return the devices to the individuals and delete any copies of the data. In his judgment, the judge included a direction (referred to as a “rider”) that, when writing to the former employees, the defendants should not highlight that compliance with the request would be voluntary.

Issues

It was agreed that, as a matter of English law, any relevant work-related emails held by ex-employees are deemed to remain within the control of the employer and are therefore disclosable under CPR31.8. On appeal, the main issues that the court had to decide were:

  • Does an English court have jurisdiction to order a party to request third-party custodians to produce personal devices and emails stored on them (the “jurisdiction issue”)?
  • Was the judge justified in including the “rider” (the “rider issue”)?
  • Was the review mechanism involving the IT consultants appropriate and proportionate (the “proportionality issue”)?

Jurisdiction

The Court of Appeal held that the court did have jurisdiction to require ex-employees to produce their personal devices and emails, notwithstanding the fact that only the work-related items were under the employers’ control. The court noted that CPR Part 31.5(8) provides a power to direct “how disclosure is to be given”, including “what searches are to be undertaken, of where, for what, in respect of which time periods and by whom and the extent of any search for electronically stored documents”. The judge’s order fell squarely within this provision, covering “where” (the personal devices), “for what” (work-related communications), “by whom” (the consultants) and “in respect of which time periods” (the period during which the anti-competitive arrangements were said to have been made). The CPR did not place any limitations on who could be asked to participate in a search, nor did it restrict such requests to people who could be compelled to participate if they were not prepared to do so voluntarily.

As regards the mixing of personal and work materials, the court noted that the prior case of Yasuda Ltd v. Orion Underwriting Ltd [1995] QB 174 had established that a defendant could not “rely on the inseparability of irrelevant material as a basis for declining to permit inspection, extraction and copying of relevant material”.

The court observed, however, that the position would probably have been different if the claimants had been seeking voluntary disclosure of documents that were not in the defendants’ control.

Rider on voluntary participation

The court commented that the request to the ex-employees was self-explanatory. It would be preferable for no explanation to be added, but it was inappropriate for the judge to issue a direction to that effect because it prevented the defendants from volunteering information that they would have been perfectly entitled to provide if asked for it expressly by the ex-employees. However, the court stated that it would not overturn the judge’s order on this ground alone.

Proportionality

The defendants argued that the order was disproportionate because it violated the defendants’ rights to privacy and protection of their personal data. The Court of Appeal disagreed, holding that without the power to make an order of this type, the court would not be able to deal effectively with covert arrangements, which by their very nature are often discussed away from work settings and devices. The order had been designed to provide as much protection as possible for third parties’ non-work-related data. Further, since the disclosure would be voluntary and would be for the purpose of enabling the defendants to comply with their legal obligations in the proceedings, there was no breach of GDPR.

The court did make two relatively minor criticisms of the judge’s order, neither of which was sufficient to justify overturning it:

  • It might have been preferable for the review to be conducted by independent solicitors rather than IT consultants, who were potentially more likely to miscategorise certain documents. However, none of the parties had suggested this approach to the judge, and that factor alone did not render the order disproportionate.
  • It would have been preferable to expressly state that the ex-employees and any third parties affected by the order (such as family members whose data might also be stored on the personal devices) should have liberty to apply to the court to vary the order. However, the ex-employees were sophisticated senior personnel who were likely to take that as implied.

Outcome

The order requiring the defendants to request delivery up of their ex-employees’ personal devices was upheld.

Disclosure Pilot Scheme

Background

In Pipia v BGEO Group Ltd [2021] EWHC 86 (Comm), the Commercial Court considered whether emails, texts and WhatsApp messages on the personal mobile phones of the defendant’s former CEO and the General Counsel of its Georgian subsidiary were within the defendant’s control for the purposes of the disclosure pilot. Both individuals were important witnesses of fact in the underlying dispute, which involved an alleged plan to seize control of assets belonging to the claimant. It was admitted that they had used their mobile phones to discuss matters that were relevant to the dispute.

Issues

The court had to consider whether or not the defendant had a right to inspect and take copies of the emails and messages, either under the individuals’ service contracts or else by virtue of a fiduciary duty arising out of the senior positions they held. If the defendant had such a right, it would have control of the documents for the purposes of the disclosure pilot and would be obliged to disclose any such documents that proved to be relevant to the issues in the case.

Control

Regarding the General Counsel, Cockerill J held that his service contract allowed his direct employer (the defendant’s subsidiary) to require him to disclose the contents of his mobile phone. The subsidiary in turn had a duty to provide documents to its parent company. However, it would be a step too far to conclude that this indirect chain placed the GC’s personal devices within the control of the parent company. Further, the existence and extent of any fiduciary duty owed by the GC would be a question of Georgian law, which the court was not equipped to deal with in the context of the present application. Cockerill J therefore held that the contents of his phone were not disclosable.

However, the CEO’s service contract was directly with the defendant, which was entitled to access his personal devices both under the terms of that contract and by virtue of his fiduciary duty to the defendant at common law, which as a matter of contractual construction was not limited by the terms of the contract. The contents of his phone were therefore within the defendant’s control and were disclosable.

Proportionality

The court held that it was necessary for the just disposal of proceedings to order disclosure. The evidence suggested a business environment in which the most relevant communications were likely to have been made by WhatsApp and similar means rather than by email or hard copy documents. Further, there were allegations of bad faith that were likely to be significant under Georgian law. However, the disclosure review should be undertaken by qualified solicitors rather than employees of any of the parties.

Outcome

Disclosure was granted in relation to relevant documents held on the mobile phone of the former CEO only.

Comment

These cases show that courts will take a consistent approach to the question of control of documents held on the personal devices of ex-employees, regardless of whether it arises under the disclosure pilot or under the existing CPR. In each case, it seems that the court will generally favour disclosure provided it can be achieved with proportionate effort and appropriate protection for the privacy rights of the individuals in question. Disclosure cannot be circumvented by mixing personal and work data.

However, as part of the required protective measures, it seems the courts have a preference for the data review to be conducted at least by qualified solicitors, and in some cases by solicitors who are independent of the parties. Applicants who are seeking disclosure from their opponent’s past employees would be well advised to build such protections into their proposed orders.