[Home] [Databases] [World Law] [Multidatabase Search] [Help] [Feedback]
	England and Wales Court of Appeal (Civil Division) Decisions
You are here: BAILII >> Databases >> England and Wales Court of Appeal (Civil Division) Decisions >> Phones 4U Ltd v EE Ltd & Ors [2021] EWCA Civ 116 (02 February 2021) URL: http://www.bailii.org/ew/cases/EWCA/Civ/2021/116.html Cite as: [2021] WLR 3270, [2021] EWCA Civ 116, [2021] ICR 1279, [2021] WLR(D) 75, [2022] 1 All ER (Comm) 220, [2022] 1 All ER 239, [2021] 1 WLR 3270

[New search] [Printable PDF version] [Buy ICLR report: [2021] 1 WLR 3270] [Buy ICLR report: [2021] ICR 1279] [View ICLR summary: [2021] WLR(D) 75] [Help]

IN THE COURT OF APPEAL (CIVIL DIVISION)
ON APPEAL FROM THE HIGH COURT OF JUSTICE
BUSINESS AND PROPERTY COURTS OF ENGLAND AND WALES
COMPETITION LIST (ChD)
THE HONOURABLE MR JUSTICE ROTH

		Royal Courts of Justice Strand London WC2A 2LL
		2/2/2021

Covid-19 Protocol: This judgment was handed down remotely by circulation to the parties' representatives by email, release to BAILII and publication on the Courts and Tribunals Judiciary website. The date and time for hand-down is deemed to be 10.00 a.m. on Tuesday 2nd February 2021.

Sir Geoffrey Vos, Master of the Rolls, delivering the judgment of the Court:

Introduction

1. These appeals raise questions as to the jurisdiction and the discretion of the court in relation to disclosure provided under CPR Part 31,^[1] where senior officers, employees and ex-employees of companies have or may have used their personal electronic devices to send and receive work-related messages and emails.
2. In the briefest outline, on 11 August 2020, Mr Justice Roth ordered the 2^nd to 8^th Defendants to write to individuals, described as "Personal Material Custodians" ("Custodians"),^[2] to request them to give certain e-disclosure providers ("IT consultants") engaged by the defendant that had employed them access to their personal mobile telephones and emails. The expressed purpose was to enable those consultants to search for work-related communications relating to the employer's business that would be passed to the relevant defendant for a disclosure review to be undertaken. The IT consultants were to undertake to the court to search the devices and emails for responsive material, not to disclose any other material to the defendant or its solicitors, and to return the devices and emails to the Custodians, and to delete or destroy any copies.
3. This order was made in the context of a standalone competition claim brought by Phones 4U, which has been in administration since 2014, against a number of mobile network operators ("MNOs"). Phones 4U was one of the two major retail intermediaries for mobile telephones in the UK. It had agreements with each of the MNOs for the supply of connections to retail customers. Between January 2013 and September 2014, the agreements that Phones 4U had with O2 (the UK trading name of the Telefonica defendants), Vodafone and EE (then a 50/50 joint venture between Deutsche and Orange) either expired and were not renewed or were terminated by the relevant MNO. Phones 4U alleges in these proceedings that these events resulted from exchanges or commitments between the defendants. The alleged arrangement (which is denied by the defendants) is said to infringe the prohibitions on anti-competitive arrangements under section 2 of the Competition Act 1998 and article 101 of the Treaty on the Functioning of the European Union.^[3] Phones 4U seeks damages. There are also ancillary claims against some of the defendants for breach of express and implied obligations of good faith and for procuring or inducing such breaches and for conspiracy to injure Phones 4U by unlawful means.
4. There is and was before the judge some common ground. Under CPR Part 31.8(1), a party's duty to disclose documents is limited to documents which are or have been in his "control". Under CPR Part 31.8(2), a party has or has had a document in his control if "(b) he has or has had a right to possession of it, or (c) he has or has had a right to inspect or take copies of it". It is common ground that (a) Phones 4U is ultimately seeking to obtain disclosure of work- related emails and messages that were sent to or received by the Custodians on their personal devices, and that (b) such emails and messages (if they exist) are to be regarded in English law as being in the relevant defendant's control for the purposes of CPR Part 31.8. This statement of the position applies as much to employees as to ex-employees.^[4]
5. The appeals raise 3 main issues as follows:-

i) Whether the judge had jurisdiction to order a party to request third-party Custodians voluntarily to produce personal devices and emails stored on them (the "jurisdiction issue").

ii) Whether the judge was justified in including a rider in [62] of his judgment, but not in his order, that the defendants ought not, in making the request, to tell the Custodians that they were entitled to refuse it (the "rider issue").

iii) Whether the mechanism directed by the judge involving the IT consultants was appropriate and proportionate (the "proportionality issue").

There is also an additional argument raised by Vodafone about the General Data Protection Regulation ("GDPR").^[5]

6. The essential vice that the defendants identify in the judge's order is that it, in effect, gives the court's blessing to a request to third parties to deliver up to an agent of the defendant (the IT consultant) their personal devices and personal documents, to which the relevant defendant can have no possible right. The defendants rely first on Lord Diplock's dicta in Lonrho v. Shell [1980] 1 WLR 627 ("Lonrho v. Shell") at pages 635-6: (a) that "in the absence of a presently enforceable right [to obtain the document from whoever actually holds it] there is … nothing in [RSC] Order 24 to compel a party … to take steps … to acquire one in the future", and (b) that, even if consent were likely to be obtained from the third party, the defendants were not "required by Order 24 to seek it, any more than a natural person is obliged to ask a close relative or anyone else who is a stranger to the suit to provide him with copies of documents in the ownership and possession of that other person". Secondly, they rely on Glidewell LJ's dictum in Bank of Dubai Ltd v. Galadari The Times 6 October 1992 ("Galadari") that there is "no general provision in the rules for the discovery of documents which are not in the possession, custody or power of a party, but are held by a Third Party". The judge ought not to have contemplated delivery of private devices and documents to the defendant, or to its agent, the IT consultant. Such an arrangement was disproportionate and inappropriate under CPR PD 31C^[6] and articles 5(2) and (3) of the Damages Directive (Directive 2014/104/EU, [2014] OJ L 349/1),^[7] since it infringed the privacy rights of the Custodians and their personal contacts under article 8 of the European Convention on Human Rights ("article 8").
7. Phones 4U contends that the defendants misunderstand the limited nature of the order that the judge made. The order in Galadari was objectionable because the documents which the court ordered the party to recover were not in the defendant's control. Here they are. Moreover, the order only requires a request to be made. Such a mechanism is permitted by CPR Part 31.5(8) as being "directions as to how disclosure is to be given", and proportionate and appropriate where the documents are likely to be highly relevant to the claim that is made.
8. We will now deal with the judge's judgment before turning to the issues we have already identified.

The judge's judgment

9. The judge addressed the issues on appeal at [46]-[62] of the Judgment. EE had already agreed to investigate the practicalities of giving the disclosure that Phones 4U sought. At [46], the judge noted the context citing Mr Greeno's evidence, on behalf of Phones 4U, that it was "in the nature of allegations of collusion that conspirators will likely have used relatively informal/discreet channels of communication to reach and implement any unlawful agreement or understanding". Roth J, who has great experience of competition cases, agreed, noting at [49] that: "[i]t is well-known that where companies do engage in unlawful, collusive behaviour, the individuals involved sometimes use their personal devices and may deliberately avoid using their work email or work devices".
10. Having set out CPR Part 31.8, Roth J referred to Part 31.4 which defined "document" to mean "anything in which information of any description is recorded", which PD 31A noted at [2A.1] extends to electronic documents, including email and other electronic communications, and includes deleted electronic documents. At [52], the judge referred to the note in the White Book at [31.8.2] indicating that the concept of "right to possession" in the rule covered "the situation where a party's documents [were] in the hands of a servant or agent". He cited Fairstar supra and a passage at [6-093] in Bowstead & Reynolds on Agency (21st edition, 2017) saying that, if an employee sends or receives emails or SMS messages in relation to the business of the company, they were doing so in the course of their employment so that "the employer (or in the case of an agent who is not an employee, the principal) has a right to require production by the employee of those 'documents', including after the termination of the employment or agency".
11. At [55], Roth J said that, where Custodians deny that they sent emails or messages relating to the affairs of their employer from their personal devices, it was "prima facie reasonable that in the first instance [the defendants] should request that their present or former employees or agents should make the devices available for inspection" (a similar order had been made in BES Commercial Electricity Ltd v Cheshire West and Chester Borough Council [2020] EWHC 701 (QB) ("BES Commercial")).
12. The judge recognised at [56] that ordering the individuals to hand over personal devices likely to contain personal material would interfere with their right of privacy under article 8, but thought that that did not preclude the court making the order; it meant that the order must interfere with the individuals' rights as little as possible and must be proportionate (see PD 31C and article 5(3) above).
13. There were, therefore, two measures that the judge thought were appropriate to ensure proportionality. First, the custodians should only be asked to provide their personal devices to the defendant's IT consultant rather than the defendant itself. The IT consultant would be required to give the undertakings mentioned above. Secondly, he directed that only four custodians for each defendant (to be selected by Phones 4U) would be requested to produce their personal devices.
14. Roth J said at [59] that the order would not circumvent the rules governing third-party disclosure in CPR Part 31.17, because the order was not for disclosure against the Custodians; it was an order against the defendant that it should take reasonable steps towards providing 'documents' within its own control, having regard to its position as employer or principal. The judge distinguished his order from that overturned by the Court of Appeal in Galadari. In that case, Morritt J had ordered that the defendants should by all lawful means available to them obtain possession, custody or power of the relevant documents, but the judge's order in this case fell within the court's established jurisdiction, as it sought to identify documents that were under the defendants' control. A similar order had been made in Bank St Petersburg PJSC v. Arkhangelsky (No2) [2015] EWHC 2997 (Ch) ("Bank St Petersburg"), where Hildyard J had ordered that letters be written to agents to gain access to documents for disclosure.

The relevant Rules

15. It is important to have in mind the scheme of CPR Part 31. Part 31.2 provides that a party discloses a document "by stating that the document exists or has existed". CPR Part 31.3(1)(a) provides that a party to whom a document has been disclosed has a right to inspect that document except where the "document is no longer in the control of the party who disclosed it". CPR Part 31.4 defines a "document", as we have said, as meaning "anything in which information of any description is recorded". CPR Part 31.5(8) allows the court to give directions at any point "as to how disclosure is to be given". The rule goes on to give particular examples of orders that may be made including "what searches are to be undertaken, of where, for what, in respect of which time periods and by whom and the extent of any search for electronically stored documents", but the general provision is not limited by the examples given. CPR Part 31.7 requires a party who is ordered to give standard disclosure (as in this case) to make a reasonable search for adverse documents referred to in CPR Part 31.6(b).
16. CPR Part 31.8 provides, as we have already said, that "(1) [a] party's duty to disclose documents is limited to documents which are or have been in his control", and that a document is in a party's control if "(a) it is or was in his physical possession; (b) he has or has had a right to possession of it; or (c) he has or has had a right to inspect or take copies of it".
17. CPR Part 31.12 allows the court to make an order for specific disclosure. Such an order is defined in CPR Part 31.12(2) as an order to disclose documents or classes of documents specified, or to carry out a search, and disclose any documents located as a result.
18. CPR Part 31.17 allows the court to make an order for disclosure against a person who is not a party to the proceedings, where the documents are likely to support or adversely affect one party's case and where disclosure is necessary in order to dispose fairly of the claim or to save costs.

The jurisdiction issue: Did the judge have jurisdiction to order a party to request the Custodians voluntarily to produce personal devices and emails stored on them?

19. Mr Mark Hoskins QC's, leading counsel for Telefonica, primary submission on this point was that the judge overreached himself because "[w]hilst a court may direct a principal to request an agent to produce documents under his control relating to the principal's affairs, it has no jurisdiction to order a principal to request an agent to produce documents that do not relate to the principal's affairs". He referred to BES Commercial at [76]-[78], and Bank St Petersburg at [43]-[45]. He submitted that:-

i) Whilst an employer has a right to production of documents from an employee relating to its business, it has no right to demand personal documents.

ii) It followed that the court did not have jurisdiction to order a defendant to disclose documents under control of employees relating to their personal affairs.

iii) The court does not have jurisdiction to require a party to seek to obtain documents from a third party which are not within the control of the party to the action, which includes requiring the party to request voluntary access.^[8]

20. Mr Hoskins submitted that the judge could have made three possible orders: (i) an order for specific disclosure under CPR Part 31.12 for classes of relevant communications within the defendant's control, but held on the Custodians' personal devices; (ii) an order similar to that made in BES Commercial, namely that the defendant request the Custodians to produce documents relating to its affairs and use its best endeavours to secure compliance with that request; or (iii) an order for third party disclosure under CPR Part 31.17.
21. Mr Hoskins submitted that what the judge was not entitled to do was to violate Lord Diplock's dictum in Lonrho v. Shell to the effect that, if the defendants could not be compelled to deliver up the Custodians' personal devices and emails, because they were not in the defendant's control, they could not be obliged to ask the Custodian to do so voluntarily.
22. On jurisdiction, the parties proceeded on the common assumption that the personal devices themselves were not in the control of the defendants. That question seems to us to be a complex one, which does not need to be answered for the purposes of our decision in this case. First, as Toulson LJ explained at [40] in North Shore Ventures Ltd v. Anstead Holdings Inc [2012] EWCA Civ 11: "[i]n determining whether documents in the physical possession of a third party are in a litigant's control for the purposes of CPR r 31.8, the court must have regard to the true nature of the relationship between the third party and the litigant". In this case, the judge did not investigate the details of those relationships, assuming at [54] that the Custodians were employees or agents of the defendants for whom they worked. Secondly, there may be a wide variety of situations ranging from a device owned by the Custodian but used mainly for work purposes on the one hand, to a device used almost exclusively for personal matters, save for an isolated work email perhaps sent in error from the wrong device. Thirdly, whilst the definition of "document" in CPR Part 31.4 and in paragraphs 1 and 5(3) of PD31B is wide, it is not immediately obvious from those provisions that it is intended to include the device itself or the chip within it. It may do in some circumstances, but in the absence of full argument, we prefer to express no opinion on the point. It may be noted in this connection that many documents are, in the modern world, not actually stored on the device at all, but in cloud storage.
23. In answer to Phones 4U's submission that CPR Part 31.5(8) itself gave the court jurisdiction to make the order it made, Mr Hoskins replied that CPR Part 31.5(8) was a facilitating rather than a jurisdictional provision, which could not give the court any power it did not otherwise have.
24. We accept that the court has no jurisdiction under CPR Part 31 to order a defendant to disclose or allow inspection of documents that are not within its control. Save that the House of Lords was concerned with documents in the "possession, custody or power" of the defendant under RSC Order 24, that was what Lonrho v. Shell decided. That, however, in our judgment, is the limit of the jurisdictional point.
25. Disclosure is an essentially pragmatic process aimed at ensuring that, so far as possible,^[9] the relevant documents are placed before the court at trial to enable it to make just and fair decisions on the issues between the parties. CPR Part 31 is expressly written in broad terms so as to allow the court maximum latitude to achieve this objective. It is not a straitjacket intended to create an obstacle course for parties seeking reasonable disclosure of relevant documents within the control of the other party. Some of the defendants' submissions seemed to us to have an air of that unreality. It was submitted, in effect, that, ultimately, after many (no doubt costly) applications, hearings and orders, it would indeed be possible for Phones 4U to get hold of the documents that they now know are held by the Custodians to one of the defendants' order. It was only possible, they submitted, by making applications under CPR Part 31.12, or for third party disclosure under CPR Part 31.17, or ultimately, if those were not complied with, for orders based on alleged contempt. We do not agree.
26. In our judgment, the scheme of standard disclosure in CPR Part 31 is simple and effective. A party ordered to make standard disclosure must make a reasonable search for adverse documents. In this case, the judge has made it as clear as can be that he considered it at least reasonably possible that the work-related documents on the Custodians' personal devices^[10] would be relevant to the issues. Accordingly, he must have thought that a reasonable search should be made for them so that they could, if relevant, be disclosed. The documents included within the process are, as we have said, those within the control of the defendant within CPR Part 31.8.
27. CPR Part 31.5 explains how the process of disclosure is to be undertaken. It allows the court to give directions at any point "as to how disclosure is to be given". The judge's order was, jurisdictionally, precisely within the terms of CPR Part 31.5(8) providing for "how" disclosure was to be given in this case. It explained what searches were to be undertaken. It said "where" the searches were to be made, namely in the documents controlled by the defendants but in the hands of custodians. It said "what" was to be searched for, and "in respect of which time periods". It said "by whom" those searches were to be made, namely the defendants and their IT consultants. It defined the extent of "any search for electronically stored documents", but the general provision is in any event not limited by the examples given.
28. It will be noted that there are no limitations in CPR Part 31.5 (or elsewhere) on who can be asked to participate in the search process. It is obvious that third parties can only be compelled to do anything by an order under CPR Part 31.17 or another procedure to which they are made a party. But that does not, in our judgment, mean that the court cannot, as a matter of principle, require the parties to the proceedings to make requests of third parties by way of making a search for relevant documents. We will deal with the proportionality of making such requests below.
29. We note that there has not, thus far, been much authority dealing with a situation where disclosable documents are mixed with non-disclosable confidential documents. Colman J was faced with that situation in Yasuda Ltd v. Orion Underwriting Ltd [1995] QB 174 where he said, at page 191 in relation to mixed underwriting records, that it was: "not open to the defendants to rely on the inseparability of irrelevant material as a basis for declining to permit inspection, extraction and copying of relevant material".
30. For the reasons we have given, and subject to the question of proportionality and the GDPR, we do not think there was any jurisdictional impediment to the order that the judge made. He was entitled, as a part of directing how standard disclosure was to be given, to direct the defendants to request their own Custodians voluntarily to produce to IT consultants both their personal devices and all the emails stored on them.
31. The order the judge made was, as he said at [61], a step towards the practical
    exercise of an established jurisdiction "by seeking to identify documents that fall under the Defendants' control".

The rider issue: Was the judge justified in including a rider in [62] of his judgment, but not in his order, that the defendants ought not, in making the request, to tell the Custodians that they were entitled to refuse it?

32. The next question is whether the judge was justified in commenting in [62] that "[a]s should be apparent from the above analysis, I do not consider that the Defendants, in writing to request access to the devices, should tell their custodians that they are entitled to refuse the request". The defendants levelled many criticisms at this passage, not least that it unlevelled a playing field that was otherwise level. We agree. Even though the defendants could probably not have appealed this comment on its own,^[11] we think the judge would have been better to avoid suggesting outside the order what was not within it. It was accepted that, if the Custodians had asked whether they were obliged to comply, the defendants could have said that they were not. That itself demonstrates the danger in suggesting that anything at all should be said to explain the order. It was, we think, a self-explanatory request.

The proportionality issue: Was the mechanism directed by the judge involving the IT consultants appropriate and proportionate?

33. We have already set out at [20] the three possible orders that the defendants submitted that the judge could or should have made. It was implicitly accepted that any of those orders would have been proportionate and appropriate. This state of affairs led us to suggest in the course of argument that, either an order mirroring BES Commercial or an order substituting independent solicitors for the IT consultants might be made by consent in place of the judge's order. No such agreement was reached. The debate, however, points towards the narrowness of the issue.
34. The judge made it clear at [56] that he recognised that the devices in question were the personal property of the Custodians and were "likely to contain a lot of personal and private information". He said expressly that there was, therefore, an interference with "the individuals' right of privacy under article 8". Whilst that did not, he thought, "preclude the court making an order for access to the devices and inspection", it meant that "the court must seek to ensure that the order interferes with the [Custodians'] rights as little as possible", and that "any order must be proportionate".^[12] We agree, and would add that the court is itself obliged, as a public authority, to protect the interests of persons under the Human Rights Act 1998.^[13]
35. Mr Robert O'Donoghue QC, leading counsel for Deutsche, argued before us that the order that the judge made was an egregious breach of the Custodians' article 8 rights. He pointed out the intensely personal nature of the material likely to be found in the Custodians' emails and on their devices. He submitted, in essence, that an order of this kind required the highest possible levels of protection of privacy rights of the individuals concerned at all stages before, during and after the disclosures in question.^[14] Viewed from this perspective, the judge's ruling was plainly inadequate in foisting the entirety of that responsibility on to the IT consultants as the defendants' agents.
36. We think that the position is more finely balanced. Whilst we accept that the vast majority of the documents on the devices in question will be potentially highly personal, it was the Custodians that will themselves have chosen to use them for business purposes in the first place.
37. Any order relating to the disclosure of business materials mixed with personal materials engages a number of potentially conflicting interests. The need for the due and efficient administration of justice has to be balanced against the individuals' article 8 rights of privacy. In balancing these interests, the court will seek within the bounds of the CPR and the overriding objective to find a workable solution; such a solution should not be excessively costly, time-consuming or complex. In other words, the solution must itself be reasonable and proportionate.
38. It is to be borne in mind that the present case concerns an alleged unlawful agreement, which by its nature is likely to be covert. It is obvious, as the judge pointed out, that, where companies do engage in unlawful, collusive behaviour, the individuals involved may sometimes deliberately avoid using their work email or work devices so as to conceal their dealings. The court cannot be powerless to ensure that such hidden documents are disclosed so as to allow the issues to be, as we have said, justly resolved.^[15]
39. The defendants effectively criticised four aspects of the order that the judge made: the fact that it required material to be handed to third parties at all, the involvement of the IT consultants, the fact that it was voluntary, and the lack of privacy protections for the Custodians' private material and that of their friends, family and contacts.
40. We think the judge was right to say that he was seeking an order which interfered with the Custodians' rights "as little as possible". The question we have to answer is whether the judge exercised his discretion in relation to the management of disclosure in this case in such a way that was "so plainly wrong that it must be regarded as outside the generous ambit of the discretion entrusted to the judge".^[16]
41. With that in mind, we turn to consider each of the 4 specific criticisms made.

The involvement of a third party

42. It is true that the judge could initially have made an order requiring disclosure by the defendants of specific categories of documents held on the Custodians' devices, but under the control of the defendants, under CPR Part 31.12. That would, in effect, have left it to the defendants to try to recover those documents from the Custodians. We think it likely that the effect of this course would have been further applications to the court, whether in these proceedings or in separate proceedings brought against the Custodians by the defendants. In effect, the judge was trying to short-circuit the need for satellite litigation whether in these proceedings under CPR Part 31.17 or elsewhere.
43. In our judgment, the only way to achieve that objective was to involve some third party. The judge balanced the privacy interests against the order he proposed as he was required to do. We do not think that involving a third party, even bearing in mind the likely highly sensitive nature of the personal information (which the judge understood) was in itself plainly wrong, disproportionate or unreasonable. It was inevitable that, if the Custodians were unwilling to do the exercise themselves, or if the court considered that there was a risk that they might hide evidence, that some third party would have to do it.

The involvement of IT Consultants

44. Criticism was made of the judge's suggestion of using IT consultants. It was suggested that independent solicitors might have provided a greater safeguard for the Custodians' personal information. We agree that the use of independent solicitors would have been a reasonable solution. But we note that none of the defendants actually suggested it to the judge. It is true that some IT consultants might find the task entrusted to them, namely "conducting a reasonable search for work related communications", to be a difficult one. There is, of course, a risk of false positives or negatives. But we do not think that these risks invalidate the order, when one bears in mind the seniority of the executives concerned, the nature and potential importance of the material that may be hidden on these devices, and the fact that it was the choice of at least some of the Custodians to use their personal devices for work purposes.
45. In the circumstances, and bearing in mind the comprehensive undertakings that the judge required the IT consultants to give, once again, we do not think that the judge's decision to involve them can be said to have been obviously wrong, disproportionate or unreasonable.

The voluntary nature of the order

46. The voluntary nature of the order was criticised mainly on the basis of Lord Diplock's suggestion in Lonrho v. Shell that the court cannot ask a party to do voluntarily what it could not be ordered to do. We have already explained why we do not think that that is a valid jurisdictional objection to the order that the judge made. We have also already said that we do not think that the court could have ordered the defendants to deliver up the Custodians' personal emails and devices.
47. In these circumstances, if the order the judge made does not result in the disclosure of the disclosable documents, the court will have to respond to further applications. We do not think it useful to speculate on what those might be. We have already mentioned some possibilities. All those possibilities would be far more costly and time consuming than the solution that the judge adopted. For that reason, we do not think that the voluntary nature of the order that the judge made was either wrong, unreasonable or disproportionate. Rather, we think that the order made was pragmatic and sensible even if it did not answer all the questions that may arise further down the road.
48. The defendants made much of the need for the Custodians to be told they are allowed to take legal advice in dealing with the request. Again, we do not agree. The Custodians are or were all senior MNO executives. They are perfectly capable of seeking their own legal advice or asking the defendants to provide them with independent legal advice. In fashioning a proportionate order, we do not think that, in these circumstances, the court was obliged to build in independent legal advice or warnings about its appropriateness for the Custodians.

Protection for the privacy rights of the Custodians, their family, friends and contacts

49. The starting point is that the rights under article 8 are qualified rights that have to be balanced against other competing rights. The judge addressed the Custodians' article 8 rights, if not those of their family, friends and contacts. He had fully in mind at [56]-[58] the need to protect such rights. Indeed, the whole order was designed with that in mind.
50. We note, however, that the judge's order does not expressly give the Custodians, or other third parties affected by it, liberty to apply to the court. In one sense, however, the Custodians do not need it, because they are at liberty to refuse the request. Nonetheless, we think it would have been better if the order had given such liberty to both the Custodians and their contacts. We doubt, however, that the judge would have refused such liberty had it been suggested by the numerous counsel for the defendants that appeared before him. In any event, we think such a liberty can be implied into the order, and its absence does not render the order obviously wrong, disproportionate or unreasonable, bearing in mind all we have already said about the Custodians themselves.
51. Ultimately, in our judgment, the order made was, we think, a proportionate precursor to the provision of this important disclosure. It was pre-eminently a practical application of CPR Part 31.5(8)(a). If the Custodians refuse the request, as they are fully entitled to do, some other approach will have to be adopted, as we have already said.

The data protection argument

52. Mr Rob Williams QC, counsel for Vodafone, argued that the order violated the GDPR, though he accepted in oral submissions that his concerns would be satisfied if an independent solicitor undertook the sifting process and if it were made clear that the process would be voluntary.
53. We do not think that we need to spend much time on the detail of these arguments, because it is clear that any data processing that is undertaken by the IT consultants will indeed (i) be with the consent of the Custodians as data subjects under article 6.1(a) of the GDPR, and (ii) be necessary for the IT consultant as data controller (if that is what it is) to undertake "for compliance with a legal obligation to which the controller is subject" under article 6.1(c).^[17]

Conclusions

54. For the reasons given above, we conclude that (a) the judge had jurisdiction to order the defendants to request third-party Custodians voluntarily to produce personal devices and emails stored on them, (b) the judge should not have said in his judgment that the defendants ought not, in making the request, to tell the Custodians that they were entitled to refuse it, and (c) that the mechanism directed by the judge involving the IT consultants was appropriate and proportionate. As mentioned at [50] above, we think it would have been preferable for the judge to have mentioned in his order that the Custodians and anyone else affected by the order was at liberty to apply to the court for further directions or orders.
55. Accordingly, the defendants' substantive appeals are dismissed.

Note 1    It is common ground that this is a competition claim which falls outside the Disclosure Pilot for the Business and Property Courts in PD 51U (see the specific exclusion at paragraph 1.4(1)).    [Back]

Note 2    In the context of making at paragraph 2 an order for standard disclosure.     [Back]

Note 3    Following the UK’s departure from the EU, and the end of the transition period on 31 December 2020, the article 101 prohibition on anti-competitive agreements no longer applies in the UK. Nonetheless, section 2 of the Competition Act 1998 and the other Chapter 1 and Chapter 2 prohibitions continue to apply.     [Back]

Note 4    See Fairstar Heavy Transport NV v. Adkins [2013] EWCA Civ 886 at [56] per Mummery LJ, where the Court of Appeal held that a litigating corporation was entitled to an order requiring its former CEO to give access to work-related emails on his personal computer.     [Back]

Note 5    Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.    [Back]

Note 6    Which provides at [1.5] and [1.6] that “the court may only permit disclosure … that is proportionate”, and that in order to determine proportionality “the court must in particular consider the factors set out in article 5(3) of the Damages Directive”.     [Back]

Note 7    Which provide that “national courts are able to order the disclosure of specified items of evidence or relevant categories of evidence circumscribed as precisely and as narrowly as possible on the basis of reasonable available facts in the reasoned justification”, and “Member States shall ensure that national courts limit the disclosure of evidence to that which is proportionate. In determining whether any disclosure requested by a party is proportionate, national courts shall consider the legitimate interests of all parties and third parties concerned”.    [Back]

Note 8    See Lord Diplock inLonrho v. Shell supra.    [Back]

Note 9    See Jacob LJ at [50]-[52] in Nichia Corporation v. Argos Limited [2007] EWCA Civ 741.     [Back]

Note 10    For the stated time period.    [Back]

Note 11    See Compagnie Noga D’Importation et d’Expotation SA v. Abacha (No3) [2003] 1 WLR 307 to the effect that an appeal lies against the result of a hearing rather than the reasons for the result.    [Back]

Note 12    See PD 31C and article 5(3) of the Damages Directive.     [Back]

Note 13    See section 6(3)(a).     [Back]

Note 14    See the decision of the European Court of Human Rights in Affaire Vinci Construction et GTM Génie Civil et Services v. France (63629/10 and 60567/10, 2 April 2015) at [76]-[81].    [Back]

Note 15    Nor can the court always be forced to engage in complex processes when simple economical ones are likely to produce the same result.     [Back]

Note 16    See, for example, Walbrook Trustee (Jersey) v. Fattal [2008] EWCA Civ 427 per Lawrence Collins LJ at [33].    [Back]

Note 17    See also section 8(a) of the Data Protection Act 2018, which provides that in article 6(1) of the GDPR “the reference in point (e) to processing of personal data that is necessary for the performance of a task carried out in the public interest or in the exercise of the controller’s official authority includes processing of personal data that is necessary for — (a) the administration of justice…”.    [Back]